?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
[GLUE] Rsync SAMBA_3_0 SVN r25598 in order to create the v3-0-test branch.
[Samba.git] / source / nsswitch / idmap.c
blobaa2e351c8ef30135a29ee6ebd363913a3a881924
1 /*
2 Unix SMB/CIFS implementation.
3 ID Mapping
4 Copyright (C) Tim Potter 2000
5 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
6 Copyright (C) Simo Sorce 2003-2007
7 Copyright (C) Jeremy Allison 2006
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22 */
23
24 #include "includes.h"
25 #include "winbindd.h"
26
27 #undef DBGC_CLASS
28 #define DBGC_CLASS DBGC_IDMAP
29
30 static_decl_idmap;
31
32 struct idmap_backend {
33 const char *name;
34 struct idmap_methods *methods;
35 struct idmap_backend *prev, *next;
36 };
37
38 struct idmap_alloc_backend {
39 const char *name;
40 struct idmap_alloc_methods *methods;
41 struct idmap_alloc_backend *prev, *next;
42 };
43
44 struct idmap_cache_ctx;
45
46 struct idmap_alloc_context {
47 const char *params;
48 struct idmap_alloc_methods *methods;
49 BOOL initialized;
50 };
51
52 static TALLOC_CTX *idmap_ctx = NULL;
53 static struct idmap_cache_ctx *idmap_cache;
54
55 static struct idmap_backend *backends = NULL;
56 static struct idmap_domain **idmap_domains = NULL;
57 static int num_domains = 0;
58 static int pdb_dom_num = -1;
59 static int def_dom_num = -1;
60
61 static struct idmap_alloc_backend *alloc_backends = NULL;
62 static struct idmap_alloc_context *idmap_alloc_ctx = NULL;
63
64 #define IDMAP_CHECK_RET(ret) do { \
65 if ( ! NT_STATUS_IS_OK(ret)) { \
66 DEBUG(2, ("ERROR: NTSTATUS = 0x%08x\n", NT_STATUS_V(ret))); \
67 goto done; \
68 } } while(0)
69 #define IDMAP_REPORT_RET(ret) do { \
70 if ( ! NT_STATUS_IS_OK(ret)) { \
71 DEBUG(2, ("ERROR: NTSTATUS = 0x%08x\n", NT_STATUS_V(ret))); \
72 } } while(0)
73 #define IDMAP_CHECK_ALLOC(mem) do { \
74 if (!mem) { \
75 DEBUG(0, ("Out of memory!\n")); ret = NT_STATUS_NO_MEMORY; \
76 goto done; \
77 } } while(0)
78
79 static struct idmap_methods *get_methods(struct idmap_backend *be,
80 const char *name)
81 {
82 struct idmap_backend *b;
83
84 for (b = be; b; b = b->next) {
85 if (strequal(b->name, name)) {
86 return b->methods;
87 }
88 }
89
90 return NULL;
91 }
92
93 static struct idmap_alloc_methods *get_alloc_methods(
94 struct idmap_alloc_backend *be,
95 const char *name)
96 {
97 struct idmap_alloc_backend *b;
98
99 for (b = be; b; b = b->next) {
100 if (strequal(b->name, name)) {
101 return b->methods;
102 }
103 }
104
105 return NULL;
106 }
107
108 BOOL idmap_is_offline(void)
109 {
110 return ( lp_winbind_offline_logon() &&
111 get_global_winbindd_state_offline() );
112 }
113
114 /**********************************************************************
115 Allow a module to register itself as a method.
116 **********************************************************************/
117
118 NTSTATUS smb_register_idmap(int version, const char *name,
119 struct idmap_methods *methods)
120 {
121 struct idmap_methods *test;
122 struct idmap_backend *entry;
123
124 if (!idmap_ctx) {
125 return NT_STATUS_INTERNAL_DB_ERROR;
126 }
127
128 if ((version != SMB_IDMAP_INTERFACE_VERSION)) {
129 DEBUG(0, ("Failed to register idmap module.\n"
130 "The module was compiled against "
131 "SMB_IDMAP_INTERFACE_VERSION %d,\n"
132 "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
133 "Please recompile against the current version "
134 "of samba!\n",
135 version, SMB_IDMAP_INTERFACE_VERSION));
136 return NT_STATUS_OBJECT_TYPE_MISMATCH;
137 }
138
139 if (!name || !name[0] || !methods) {
140 DEBUG(0,("Called with NULL pointer or empty name!\n"));
141 return NT_STATUS_INVALID_PARAMETER;
142 }
143
144 test = get_methods(backends, name);
145 if (test) {
146 DEBUG(0,("Idmap module %s already registered!\n", name));
147 return NT_STATUS_OBJECT_NAME_COLLISION;
148 }
149
150 entry = talloc(idmap_ctx, struct idmap_backend);
151 if ( ! entry) {
152 DEBUG(0,("Out of memory!\n"));
153 return NT_STATUS_NO_MEMORY;
154 }
155 entry->name = talloc_strdup(idmap_ctx, name);
156 if ( ! entry->name) {
157 DEBUG(0,("Out of memory!\n"));
158 return NT_STATUS_NO_MEMORY;
159 }
160 entry->methods = methods;
161
162 DLIST_ADD(backends, entry);
163 DEBUG(5, ("Successfully added idmap backend '%s'\n", name));
164 return NT_STATUS_OK;
165 }
166
167 /**********************************************************************
168 Allow a module to register itself as a method.
169 **********************************************************************/
170
171 NTSTATUS smb_register_idmap_alloc(int version, const char *name,
172 struct idmap_alloc_methods *methods)
173 {
174 struct idmap_alloc_methods *test;
175 struct idmap_alloc_backend *entry;
176
177 if (!idmap_ctx) {
178 return NT_STATUS_INTERNAL_DB_ERROR;
179 }
180
181 if ((version != SMB_IDMAP_INTERFACE_VERSION)) {
182 DEBUG(0, ("Failed to register idmap alloc module.\n"
183 "The module was compiled against "
184 "SMB_IDMAP_INTERFACE_VERSION %d,\n"
185 "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
186 "Please recompile against the current version "
187 "of samba!\n",
188 version, SMB_IDMAP_INTERFACE_VERSION));
189 return NT_STATUS_OBJECT_TYPE_MISMATCH;
190 }
191
192 if (!name || !name[0] || !methods) {
193 DEBUG(0,("Called with NULL pointer or empty name!\n"));
194 return NT_STATUS_INVALID_PARAMETER;
195 }
196
197 test = get_alloc_methods(alloc_backends, name);
198 if (test) {
199 DEBUG(0,("idmap_alloc module %s already registered!\n", name));
200 return NT_STATUS_OBJECT_NAME_COLLISION;
201 }
202
203 entry = talloc(idmap_ctx, struct idmap_alloc_backend);
204 if ( ! entry) {
205 DEBUG(0,("Out of memory!\n"));
206 return NT_STATUS_NO_MEMORY;
207 }
208 entry->name = talloc_strdup(idmap_ctx, name);
209 if ( ! entry->name) {
210 DEBUG(0,("Out of memory!\n"));
211 return NT_STATUS_NO_MEMORY;
212 }
213 entry->methods = methods;
214
215 DLIST_ADD(alloc_backends, entry);
216 DEBUG(5, ("Successfully added idmap alloc backend '%s'\n", name));
217 return NT_STATUS_OK;
218 }
219
220 static int close_domain_destructor(struct idmap_domain *dom)
221 {
222 NTSTATUS ret;
223
224 ret = dom->methods->close_fn(dom);
225 if (!NT_STATUS_IS_OK(ret)) {
226 DEBUG(3, ("Failed to close idmap domain [%s]!\n", dom->name));
227 }
228
229 return 0;
230 }
231
232 /**************************************************************************
233 Shutdown.
234 **************************************************************************/
235
236 NTSTATUS idmap_close(void)
237 {
238 /* close the alloc backend first before freeing idmap_ctx */
239 if (idmap_alloc_ctx) {
240 idmap_alloc_ctx->methods->close_fn();
241 idmap_alloc_ctx->methods = NULL;
242 }
243 alloc_backends = NULL;
244
245 /* this talloc_free call will fire the talloc destructors
246 * that will free all active backends resources */
247 TALLOC_FREE(idmap_ctx);
248 idmap_cache = NULL;
249 idmap_domains = NULL;
250 backends = NULL;
251
252 return NT_STATUS_OK;
253 }
254
255 /**********************************************************************
256 Initialise idmap cache and a remote backend (if configured).
257 **********************************************************************/
258
259 static const char *idmap_default_domain[] = { "default domain", NULL };
260
261 /****************************************************************************
262 ****************************************************************************/
263
264 NTSTATUS idmap_init_cache(void)
265 {
266 /* Always initialize the cache. We'll have to delay initialization
267 of backends if we are offline */
268
269 if ( idmap_ctx ) {
270 return NT_STATUS_OK;
271 }
272
273 if ( (idmap_ctx = talloc_named_const(NULL, 0, "idmap_ctx")) == NULL ) {
274 return NT_STATUS_NO_MEMORY;
275 }
276
277 if ( (idmap_cache = idmap_cache_init(idmap_ctx)) == NULL ) {
278 return NT_STATUS_UNSUCCESSFUL;
279 }
280
281 return NT_STATUS_OK;
282 }
283
284 /****************************************************************************
285 ****************************************************************************/
286
287 NTSTATUS idmap_init(void)
288 {
289 NTSTATUS ret;
290 static NTSTATUS idmap_init_status = NT_STATUS_UNSUCCESSFUL;
291 struct idmap_domain *dom;
292 char *compat_backend = NULL;
293 char *compat_params = NULL;
294 const char **dom_list = NULL;
295 char *alloc_backend = NULL;
296 BOOL default_already_defined = False;
297 BOOL pri_dom_is_in_list = False;
298 int compat = 0;
299 int i;
300
301 ret = idmap_init_cache();
302 if (!NT_STATUS_IS_OK(ret))
303 return ret;
304
305 if (NT_STATUS_IS_OK(idmap_init_status))
306 return NT_STATUS_OK;
307
308 static_init_idmap;
309
310 dom_list = lp_idmap_domains();
311
312 if ( lp_idmap_backend() ) {
313 const char **compat_list = lp_idmap_backend();
314 char *p = NULL;
315 const char *q = NULL;
316
317 if (dom_list) {
318 DEBUG(0, ("WARNING: idmap backend and idmap domains "
319 "are mutually excusive!\n"));
320 DEBUGADD(0,("idmap backend option will be IGNORED!\n"));
321 } else {
322 compat = 1;
323
324 compat_backend = talloc_strdup(idmap_ctx, *compat_list);
325 if (compat_backend == NULL) {
326 ret = NT_STATUS_NO_MEMORY;
327 goto done;
328 }
329
330 /* strip any leading idmap_ prefix of */
331 if (strncmp(*compat_list, "idmap_", 6) == 0 ) {
332 q = *compat_list += 6;
333 DEBUG(0, ("WARNING: idmap backend uses obsolete"
334 " and deprecated 'idmap_' prefix.\n"
335 "Please replace 'idmap_%s' by '%s' in"
336 " %s\n", q, q, dyn_CONFIGFILE));
337 compat_backend = talloc_strdup(idmap_ctx, q);
338 } else {
339 compat_backend = talloc_strdup(idmap_ctx,
340 *compat_list);
341 }
342
343 /* separate the backend and module arguements */
344 if ((p = strchr(compat_backend, ':')) != NULL) {
345 *p = '\0';
346 compat_params = p + 1;
347 }
348 }
349 } else if ( !dom_list ) {
350 /* Back compatible: without idmap domains and explicit
351 idmap backend. Taking default idmap backend: tdb */
352
353 compat = 1;
354 compat_backend = talloc_strdup( idmap_ctx, "tdb");
355 compat_params = compat_backend;
356 }
357
358 if ( ! dom_list) {
359 dom_list = idmap_default_domain;
360 }
361
362 /***************************
363 * initialize idmap domains
364 */
365 DEBUG(1, ("Initializing idmap domains\n"));
366
367 for (i = 0; dom_list[i]; i++) {
368 const char *parm_backend;
369 char *config_option;
370
371 /* ignore BUILTIN and local MACHINE domains */
372 if (strequal(dom_list[i], "BUILTIN")
373 || strequal(dom_list[i], get_global_sam_name()))
374 {
375 DEBUG(0,("idmap_init: Ignoring invalid domain %s\n",
376 dom_list[i]));
377 continue;
378 }
379
380 if (strequal(dom_list[i], lp_workgroup())) {
381 pri_dom_is_in_list = True;
382 }
383 /* init domain */
384
385 dom = TALLOC_ZERO_P(idmap_ctx, struct idmap_domain);
386 IDMAP_CHECK_ALLOC(dom);
387
388 dom->name = talloc_strdup(dom, dom_list[i]);
389 IDMAP_CHECK_ALLOC(dom->name);
390
391 config_option = talloc_asprintf(dom, "idmap config %s",
392 dom->name);
393 IDMAP_CHECK_ALLOC(config_option);
394
395 /* default or specific ? */
396
397 dom->default_domain = lp_parm_bool(-1, config_option,
398 "default", False);
399
400 if (dom->default_domain ||
401 strequal(dom_list[i], idmap_default_domain[0])) {
402
403 /* make sure this is set even when we match
404 * idmap_default_domain[0] */
405 dom->default_domain = True;
406
407 if (default_already_defined) {
408 DEBUG(1, ("ERROR: Multiple domains defined as"
409 " default!\n"));
410 ret = NT_STATUS_INVALID_PARAMETER;
411 goto done;
412 }
413
414 default_already_defined = True;
415
416 }
417
418 dom->readonly = lp_parm_bool(-1, config_option,
419 "readonly", False);
420
421 /* find associated backend (default: tdb) */
422 if (compat) {
423 parm_backend = talloc_strdup(idmap_ctx, compat_backend);
424 } else {
425 parm_backend = talloc_strdup(idmap_ctx,
426 lp_parm_const_string(
427 -1, config_option,
428 "backend", "tdb"));
429 }
430 IDMAP_CHECK_ALLOC(parm_backend);
431
432 /* get the backend methods for this domain */
433 dom->methods = get_methods(backends, parm_backend);
434
435 if ( ! dom->methods) {
436 ret = smb_probe_module("idmap", parm_backend);
437 if (NT_STATUS_IS_OK(ret)) {
438 dom->methods = get_methods(backends,
439 parm_backend);
440 }
441 }
442 if ( ! dom->methods) {
443 DEBUG(0, ("ERROR: Could not get methods for "
444 "backend %s\n", parm_backend));
445 ret = NT_STATUS_UNSUCCESSFUL;
446 goto done;
447 }
448
449 /* check the set_mapping function exists otherwise mark the
450 * module as readonly */
451 if ( ! dom->methods->set_mapping) {
452 DEBUG(5, ("Forcing to readonly, as this module can't"
453 " store arbitrary mappings.\n"));
454 dom->readonly = True;
455 }
456
457 /* now that we have methods,
458 * set the destructor for this domain */
459 talloc_set_destructor(dom, close_domain_destructor);
460
461 if (compat_params) {
462 dom->params = talloc_strdup(dom, compat_params);
463 IDMAP_CHECK_ALLOC(dom->params);
464 } else {
465 dom->params = NULL;
466 }
467
468 /* Finally instance a backend copy for this domain */
469 ret = dom->methods->init(dom);
470 if ( ! NT_STATUS_IS_OK(ret)) {
471 DEBUG(0, ("ERROR: Initialization failed for backend "
472 "%s (domain %s), deferred!\n",
473 parm_backend, dom->name));
474 }
475 idmap_domains = talloc_realloc(idmap_ctx, idmap_domains,
476 struct idmap_domain *, i+1);
477 if ( ! idmap_domains) {
478 DEBUG(0, ("Out of memory!\n"));
479 ret = NT_STATUS_NO_MEMORY;
480 goto done;
481 }
482 idmap_domains[i] = dom;
483
484 /* save default domain position for future uses */
485 if (dom->default_domain) {
486 def_dom_num = i;
487 }
488
489 DEBUG(10, ("Domain %s - Backend %s - %sdefault - %sreadonly\n",
490 dom->name, parm_backend,
491 dom->default_domain?"":"not ",
492 dom->readonly?"":"not "));
493
494 talloc_free(config_option);
495 }
496
497 /* save the number of domains we have */
498 num_domains = i;
499
500 /* automatically add idmap_nss backend if needed */
501 if ((lp_server_role() == ROLE_DOMAIN_MEMBER) &&
502 ( ! pri_dom_is_in_list) &&
503 lp_winbind_trusted_domains_only()) {
504
505 dom = TALLOC_ZERO_P(idmap_ctx, struct idmap_domain);
506 IDMAP_CHECK_ALLOC(dom);
507
508 dom->name = talloc_strdup(dom, lp_workgroup());
509 IDMAP_CHECK_ALLOC(dom->name);
510
511 dom->default_domain = False;
512 dom->readonly = True;
513
514 /* get the backend methods for passdb */
515 dom->methods = get_methods(backends, "nss");
516
517 /* (the nss module is always statically linked) */
518 if ( ! dom->methods) {
519 DEBUG(0, ("ERROR: No methods for idmap_nss ?!\n"));
520 ret = NT_STATUS_UNSUCCESSFUL;
521 goto done;
522 }
523
524 /* now that we have methods,
525 * set the destructor for this domain */
526 talloc_set_destructor(dom, close_domain_destructor);
527
528 if (compat_params) {
529 dom->params = talloc_strdup(dom, compat_params);
530 IDMAP_CHECK_ALLOC(dom->params);
531 } else {
532 dom->params = NULL;
533 }
534
535 /* Finally instance a backend copy for this domain */
536 ret = dom->methods->init(dom);
537 if ( ! NT_STATUS_IS_OK(ret)) {
538 DEBUG(0, ("ERROR: Init. failed for idmap_nss ?!\n"));
539 ret = NT_STATUS_UNSUCCESSFUL;
540 goto done;
541 }
542
543 idmap_domains = talloc_realloc(idmap_ctx,
544 idmap_domains,
545 struct idmap_domain *,
546 num_domains+1);
547 if ( ! idmap_domains) {
548 DEBUG(0, ("Out of memory!\n"));
549 ret = NT_STATUS_NO_MEMORY;
550 goto done;
551 }
552 idmap_domains[num_domains] = dom;
553
554 DEBUG(10, ("Domain %s - Backend nss - not default - readonly\n",
555 dom->name ));
556
557 num_domains++;
558 }
559
560 /**** automatically add idmap_passdb backend ****/
561 dom = TALLOC_ZERO_P(idmap_ctx, struct idmap_domain);
562 IDMAP_CHECK_ALLOC(dom);
563
564 dom->name = talloc_strdup(dom, get_global_sam_name());
565 IDMAP_CHECK_ALLOC(dom->name);
566
567 dom->default_domain = False;
568 dom->readonly = True;
569
570 /* get the backend methods for passdb */
571 dom->methods = get_methods(backends, "passdb");
572
573 /* (the passdb module is always statically linked) */
574 if ( ! dom->methods) {
575 DEBUG(0, ("ERROR: No methods for idmap_passdb ?!\n"));
576 ret = NT_STATUS_UNSUCCESSFUL;
577 goto done;
578 }
579
580 /* now that we have methods, set the destructor for this domain */
581 talloc_set_destructor(dom, close_domain_destructor);
582
583 if (compat_params) {
584 dom->params = talloc_strdup(dom, compat_params);
585 IDMAP_CHECK_ALLOC(dom->params);
586 } else {
587 dom->params = NULL;
588 }
589
590 /* Finally instance a backend copy for this domain */
591 ret = dom->methods->init(dom);
592 if ( ! NT_STATUS_IS_OK(ret)) {
593 DEBUG(0, ("ERROR: Init. failed for idmap_passdb ?!\n"));
594 ret = NT_STATUS_UNSUCCESSFUL;
595 goto done;
596 }
597
598 idmap_domains = talloc_realloc(idmap_ctx,
599 idmap_domains,
600 struct idmap_domain *,
601 num_domains+1);
602 if ( ! idmap_domains) {
603 DEBUG(0, ("Out of memory!\n"));
604 ret = NT_STATUS_NO_MEMORY;
605 goto done;
606 }
607 idmap_domains[num_domains] = dom;
608
609 /* needed to handle special BUILTIN and wellknown SIDs cases */
610 pdb_dom_num = num_domains;
611
612 DEBUG(10, ("Domain %s - Backend passdb - not default - readonly\n",
613 dom->name));
614
615 num_domains++;
616 /**** finished adding idmap_passdb backend ****/
617
618 /* sort domains so that the default is the last one */
619 /* don't sort if no default domain defined */
620 if (def_dom_num != -1 && def_dom_num != num_domains-1) {
621 /* default is not last, move it */
622 struct idmap_domain *tmp;
623
624 if (pdb_dom_num > def_dom_num) {
625 pdb_dom_num --;
626
627 } else if (pdb_dom_num == def_dom_num) { /* ?? */
628 pdb_dom_num = num_domains - 1;
629 }
630
631 tmp = idmap_domains[def_dom_num];
632
633 for (i = def_dom_num; i < num_domains-1; i++) {
634 idmap_domains[i] = idmap_domains[i+1];
635 }
636 idmap_domains[i] = tmp;
637 def_dom_num = i;
638 }
639
640
641 /* Initialize alloc module */
642
643 DEBUG(3, ("Initializing idmap alloc module\n"));
644
645 alloc_backend = NULL;
646 if (compat) {
647 alloc_backend = talloc_strdup(idmap_ctx, compat_backend);
648 } else {
649 char *ab = lp_idmap_alloc_backend();
650
651 if (ab && (ab[0] != '\0')) {
652 alloc_backend = talloc_strdup(idmap_ctx,
653 lp_idmap_alloc_backend());
654 }
655 }
656
657 if ( alloc_backend ) {
658
659 idmap_alloc_ctx = TALLOC_ZERO_P(idmap_ctx,
660 struct idmap_alloc_context);
661 IDMAP_CHECK_ALLOC(idmap_alloc_ctx);
662
663 idmap_alloc_ctx->methods = get_alloc_methods(alloc_backends,
664 alloc_backend);
665 if ( ! idmap_alloc_ctx->methods) {
666 ret = smb_probe_module("idmap", alloc_backend);
667 if (NT_STATUS_IS_OK(ret)) {
668 idmap_alloc_ctx->methods =
669 get_alloc_methods(alloc_backends,
670 alloc_backend);
671 }
672 }
673 if (idmap_alloc_ctx->methods) {
674
675 if (compat_params) {
676 idmap_alloc_ctx->params =
677 talloc_strdup(idmap_alloc_ctx,
678 compat_params);
679 IDMAP_CHECK_ALLOC(idmap_alloc_ctx->params);
680 } else {
681 idmap_alloc_ctx->params = NULL;
682 }
683
684 ret = idmap_alloc_ctx->methods->init(idmap_alloc_ctx->params);
685 if ( ! NT_STATUS_IS_OK(ret)) {
686 DEBUG(0, ("ERROR: Initialization failed for "
687 "alloc backend %s, deferred!\n",
688 alloc_backend));
689 } else {
690 idmap_alloc_ctx->initialized = True;
691 }
692 } else {
693 DEBUG(2, ("idmap_init: Unable to get methods for "
694 "alloc backend %s\n",
695 alloc_backend));
696 /* certain compat backends are just readonly */
697 if ( compat ) {
698 TALLOC_FREE(idmap_alloc_ctx);
699 ret = NT_STATUS_OK;
700 } else {
701 ret = NT_STATUS_UNSUCCESSFUL;
702 }
703 }
704 }
705
706 /* cleanpu temporary strings */
707 TALLOC_FREE( compat_backend );
708
709 idmap_init_status = NT_STATUS_OK;
710
711 return ret;
712
713 done:
714 DEBUG(0, ("Aborting IDMAP Initialization ...\n"));
715 idmap_close();
716
717 return ret;
718 }
719
720 static NTSTATUS idmap_alloc_init(void)
721 {
722 NTSTATUS ret;
723
724 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
725 return ret;
726 }
727
728 if ( ! idmap_alloc_ctx) {
729 return NT_STATUS_NOT_SUPPORTED;
730 }
731
732 if ( ! idmap_alloc_ctx->initialized) {
733 ret = idmap_alloc_ctx->methods->init(idmap_alloc_ctx->params);
734 if ( ! NT_STATUS_IS_OK(ret)) {
735 DEBUG(0, ("ERROR: Initialization failed for alloc "
736 "backend, deferred!\n"));
737 return ret;
738 } else {
739 idmap_alloc_ctx->initialized = True;
740 }
741 }
742
743 return NT_STATUS_OK;
744 }
745
746 /**************************************************************************
747 idmap allocator interface functions
748 **************************************************************************/
749
750 NTSTATUS idmap_allocate_uid(struct unixid *id)
751 {
752 NTSTATUS ret;
753
754 if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
755 return ret;
756 }
757
758 id->type = ID_TYPE_UID;
759 return idmap_alloc_ctx->methods->allocate_id(id);
760 }
761
762 NTSTATUS idmap_allocate_gid(struct unixid *id)
763 {
764 NTSTATUS ret;
765
766 if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
767 return ret;
768 }
769
770 id->type = ID_TYPE_GID;
771 return idmap_alloc_ctx->methods->allocate_id(id);
772 }
773
774 NTSTATUS idmap_set_uid_hwm(struct unixid *id)
775 {
776 NTSTATUS ret;
777
778 if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
779 return ret;
780 }
781
782 id->type = ID_TYPE_UID;
783 return idmap_alloc_ctx->methods->set_id_hwm(id);
784 }
785
786 NTSTATUS idmap_set_gid_hwm(struct unixid *id)
787 {
788 NTSTATUS ret;
789
790 if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
791 return ret;
792 }
793
794 id->type = ID_TYPE_GID;
795 return idmap_alloc_ctx->methods->set_id_hwm(id);
796 }
797
798 /******************************************************************************
799 Lookup an idmap_domain give a full user or group SID
800 ******************************************************************************/
801
802 static struct idmap_domain* find_idmap_domain_from_sid( DOM_SID *account_sid )
803 {
804 DOM_SID domain_sid;
805 uint32 rid;
806 struct winbindd_domain *domain = NULL;
807 int i;
808
809 /* 1. Handle BUILTIN or Special SIDs and prevent them from
810 falling into the default domain space (if we have a
811 configured passdb backend. */
812
813 if ( (pdb_dom_num != -1) &&
814 (sid_check_is_in_builtin(account_sid) ||
815 sid_check_is_in_wellknown_domain(account_sid) ||
816 sid_check_is_in_unix_groups(account_sid) ||
817 sid_check_is_in_unix_users(account_sid)) )
818 {
819 return idmap_domains[pdb_dom_num];
820 }
821
822 /* 2. Lookup the winbindd_domain from the account_sid */
823
824 sid_copy( &domain_sid, account_sid );
825 sid_split_rid( &domain_sid, &rid );
826 domain = find_domain_from_sid_noinit( &domain_sid );
827
828 for (i = 0; domain && i < num_domains; i++) {
829 if ( strequal( idmap_domains[i]->name, domain->name ) ) {
830 return idmap_domains[i];
831 }
832 }
833
834 /* 3. Fall back to the default domain */
835
836 if ( def_dom_num != -1 ) {
837 return idmap_domains[def_dom_num];
838 }
839
840 return NULL;
841 }
842
843 /******************************************************************************
844 Lookup an index given an idmap_domain pointer
845 ******************************************************************************/
846
847 static uint32 find_idmap_domain_index( struct idmap_domain *id_domain)
848 {
849 int i;
850
851 for (i = 0; i < num_domains; i++) {
852 if ( idmap_domains[i] == id_domain )
853 return i;
854 }
855
856 return -1;
857 }
858
859
860 /*********************************************************
861 Check if creating a mapping is permitted for the domain
862 *********************************************************/
863
864 static NTSTATUS idmap_can_map(const struct id_map *map,
865 struct idmap_domain **ret_dom)
866 {
867 struct idmap_domain *dom;
868
869 /* Check we do not create mappings for our own local domain,
870 * or BUILTIN or special SIDs */
871 if ((sid_compare_domain(map->sid, get_global_sam_sid()) == 0) ||
872 sid_check_is_in_builtin(map->sid) ||
873 sid_check_is_in_wellknown_domain(map->sid)) {
874 DEBUG(10, ("We are not supposed to create mappings for "
875 "our own domains (local, builtin, specials)\n"));
876 return NT_STATUS_UNSUCCESSFUL;
877 }
878
879 /* Special check for trusted domain only = Yes */
880 if (lp_winbind_trusted_domains_only()) {
881 struct winbindd_domain *wdom = find_our_domain();
882 if (wdom && (sid_compare_domain(map->sid, &wdom->sid) == 0)) {
883 DEBUG(10, ("We are not supposed to create mappings for "
884 "our primary domain when <trusted domain "
885 "only> is True\n"));
886 DEBUGADD(10, ("Leave [%s] unmapped\n",
887 sid_string_static(map->sid)));
888 return NT_STATUS_UNSUCCESSFUL;
889 }
890 }
891
892 if ( (dom = find_idmap_domain_from_sid( map->sid )) == NULL ) {
893 /* huh, couldn't find a suitable domain,
894 * let's just leave it unmapped */
895 DEBUG(10, ("Could not find idmap backend for SID %s",
896 sid_string_static(map->sid)));
897 return NT_STATUS_NO_SUCH_DOMAIN;
898 }
899
900 if (dom->readonly) {
901 /* ouch the domain is read only,
902 * let's just leave it unmapped */
903 DEBUG(10, ("idmap backend for SID %s is READONLY!\n",
904 sid_string_static(map->sid)));
905 return NT_STATUS_UNSUCCESSFUL;
906 }
907
908 *ret_dom = dom;
909 return NT_STATUS_OK;
910 }
911
912 static NTSTATUS idmap_new_mapping(TALLOC_CTX *ctx, struct id_map *map)
913 {
914 NTSTATUS ret;
915 struct idmap_domain *dom;
916
917 /* If we are offline we cannot lookup SIDs, deny mapping */
918 if (idmap_is_offline()) {
919 return NT_STATUS_FILE_IS_OFFLINE;
920 }
921
922 ret = idmap_can_map(map, &dom);
923 if ( ! NT_STATUS_IS_OK(ret)) {
924 return NT_STATUS_NONE_MAPPED;
925 }
926
927 /* check if this is a valid SID and then map it */
928 switch (map->xid.type) {
929 case ID_TYPE_UID:
930 ret = idmap_allocate_uid(&map->xid);
931 if ( ! NT_STATUS_IS_OK(ret)) {
932 /* can't allocate id, let's just leave it unmapped */
933 DEBUG(2, ("uid allocation failed! "
934 "Can't create mapping\n"));
935 return NT_STATUS_NONE_MAPPED;
936 }
937 break;
938 case ID_TYPE_GID:
939 ret = idmap_allocate_gid(&map->xid);
940 if ( ! NT_STATUS_IS_OK(ret)) {
941 /* can't allocate id, let's just leave it unmapped */
942 DEBUG(2, ("gid allocation failed! "
943 "Can't create mapping\n"));
944 return NT_STATUS_NONE_MAPPED;
945 }
946 break;
947 default:
948 /* invalid sid, let's just leave it unmapped */
949 DEBUG(3,("idmap_new_mapping: Refusing to create a "
950 "mapping for an unspecified ID type.\n"));
951 return NT_STATUS_NONE_MAPPED;
952 }
953
954 /* ok, got a new id, let's set a mapping */
955 map->status = ID_MAPPED;
956
957 DEBUG(10, ("Setting mapping: %s <-> %s %lu\n",
958 sid_string_static(map->sid),
959 (map->xid.type == ID_TYPE_UID) ? "UID" : "GID",
960 (unsigned long)map->xid.id));
961 ret = dom->methods->set_mapping(dom, map);
962
963 if ( ! NT_STATUS_IS_OK(ret)) {
964 /* something wrong here :-( */
965 DEBUG(2, ("Failed to commit mapping\n!"));
966
967 /* TODO: would it make sense to have an "unalloc_id function?" */
968
969 return NT_STATUS_NONE_MAPPED;
970 }
971
972 return NT_STATUS_OK;
973 }
974
975 static NTSTATUS idmap_backends_set_mapping(const struct id_map *map)
976 {
977 struct idmap_domain *dom;
978 NTSTATUS ret;
979
980 DEBUG(10, ("Setting mapping %s <-> %s %lu\n",
981 sid_string_static(map->sid),
982 (map->xid.type == ID_TYPE_UID) ? "UID" : "GID",
983 (unsigned long)map->xid.id));
984
985 ret = idmap_can_map(map, &dom);
986 if ( ! NT_STATUS_IS_OK(ret)) {
987 return ret;
988 }
989
990 DEBUG(10,("set_mapping for domain %s\n", dom->name ));
991
992 return dom->methods->set_mapping(dom, map);
993 }
994
995 static NTSTATUS idmap_backends_unixids_to_sids(struct id_map **ids)
996 {
997 struct idmap_domain *dom;
998 struct id_map **unmapped;
999 struct id_map **_ids;
1000 TALLOC_CTX *ctx;
1001 NTSTATUS ret;
1002 int i, u, n;
1003
1004 if (!ids || !*ids) {
1005 DEBUG(1, ("Invalid list of maps\n"));
1006 return NT_STATUS_INVALID_PARAMETER;
1007 }
1008
1009 ctx = talloc_named_const(NULL, 0, "idmap_backends_unixids_to_sids ctx");
1010 if ( ! ctx) {
1011 DEBUG(0, ("Out of memory!\n"));
1012 return NT_STATUS_NO_MEMORY;
1013 }
1014
1015 DEBUG(10, ("Query backends to map ids->sids\n"));
1016
1017 /* start from the default (the last one) and then if there are still
1018 * unmapped entries cycle through the others */
1019
1020 _ids = ids;
1021
1022 unmapped = NULL;
1023 for (n = num_domains-1; n >= 0; n--) { /* cycle backwards */
1024
1025 dom = idmap_domains[n];
1026
1027 DEBUG(10, ("Query sids from domain %s\n", dom->name));
1028
1029 ret = dom->methods->unixids_to_sids(dom, _ids);
1030 IDMAP_REPORT_RET(ret);
1031
1032 unmapped = NULL;
1033
1034 for (i = 0, u = 0; _ids[i]; i++) {
1035 if (_ids[i]->status != ID_MAPPED) {
1036 unmapped = talloc_realloc(ctx, unmapped,
1037 struct id_map *, u + 2);
1038 IDMAP_CHECK_ALLOC(unmapped);
1039 unmapped[u] = _ids[i];
1040 u++;
1041 }
1042 }
1043 if (unmapped) {
1044 /* terminate the unmapped list */
1045 unmapped[u] = NULL;
1046 } else { /* no more entries, get out */
1047 break;
1048 }
1049
1050 _ids = unmapped;
1051
1052 }
1053
1054 if (unmapped) {
1055 /* there are still unmapped ids,
1056 * map them to the unix users/groups domains */
1057 /* except for expired entries,
1058 * these will be returned as valid (offline mode) */
1059 for (i = 0; unmapped[i]; i++) {
1060 if (unmapped[i]->status == ID_EXPIRED) continue;
1061 switch (unmapped[i]->xid.type) {
1062 case ID_TYPE_UID:
1063 uid_to_unix_users_sid(
1064 (uid_t)unmapped[i]->xid.id,
1065 unmapped[i]->sid);
1066 unmapped[i]->status = ID_MAPPED;
1067 break;
1068 case ID_TYPE_GID:
1069 gid_to_unix_groups_sid(
1070 (gid_t)unmapped[i]->xid.id,
1071 unmapped[i]->sid);
1072 unmapped[i]->status = ID_MAPPED;
1073 break;
1074 default: /* what?! */
1075 unmapped[i]->status = ID_UNKNOWN;
1076 break;
1077 }
1078 }
1079 }
1080
1081 ret = NT_STATUS_OK;
1082
1083 done:
1084 talloc_free(ctx);
1085 return ret;
1086 }
1087
1088 static NTSTATUS idmap_backends_sids_to_unixids(struct id_map **ids)
1089 {
1090 struct id_map ***dom_ids;
1091 struct idmap_domain *dom;
1092 TALLOC_CTX *ctx;
1093 NTSTATUS ret;
1094 int i, *counters;
1095
1096 if ( (ctx = talloc_named_const(NULL, 0, "be_sids_to_ids")) == NULL ) {
1097 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1098 return NT_STATUS_NO_MEMORY;
1099 }
1100
1101 DEBUG(10, ("Query backends to map sids->ids\n"));
1102
1103 /* split list per domain */
1104 if (num_domains == 0) {
1105 DEBUG(1, ("No domains available?\n"));
1106 return NT_STATUS_UNSUCCESSFUL;
1107 }
1108
1109 dom_ids = TALLOC_ZERO_ARRAY(ctx, struct id_map **, num_domains);
1110 IDMAP_CHECK_ALLOC(dom_ids);
1111 counters = TALLOC_ZERO_ARRAY(ctx, int, num_domains);
1112 IDMAP_CHECK_ALLOC(counters);
1113
1114 /* partition the requests by domain */
1115
1116 for (i = 0; ids[i]; i++) {
1117 uint32 idx;
1118
1119 if ((dom = find_idmap_domain_from_sid(ids[i]->sid)) == NULL) {
1120 /* no available idmap_domain. Move on */
1121 continue;
1122 }
1123
1124 DEBUG(10,("SID %s is being handled by %s\n",
1125 sid_string_static(ids[i]->sid),
1126 dom ? dom->name : "none" ));
1127
1128 idx = find_idmap_domain_index( dom );
1129 SMB_ASSERT( idx != -1 );
1130
1131 dom_ids[idx] = talloc_realloc(ctx, dom_ids[idx],
1132 struct id_map *,
1133 counters[idx] + 2);
1134 IDMAP_CHECK_ALLOC(dom_ids[idx]);
1135
1136 dom_ids[idx][counters[idx]] = ids[i];
1137 counters[idx]++;
1138 dom_ids[idx][counters[idx]] = NULL;
1139 }
1140
1141 /* All the ids have been dispatched in the right queues.
1142 Let's cycle through the filled ones */
1143
1144 for (i = 0; i < num_domains; i++) {
1145 if (dom_ids[i]) {
1146 dom = idmap_domains[i];
1147 DEBUG(10, ("Query ids from domain %s\n", dom->name));
1148 ret = dom->methods->sids_to_unixids(dom, dom_ids[i]);
1149 IDMAP_REPORT_RET(ret);
1150 }
1151 }
1152
1153 /* ok all the backends have been contacted at this point */
1154 /* let's see if we have any unmapped SID left and act accordingly */
1155
1156 for (i = 0; ids[i]; i++) {
1157 /* NOTE: this will NOT touch ID_EXPIRED entries that the backend
1158 * was not able to confirm/deny (offline mode) */
1159 if (ids[i]->status == ID_UNKNOWN ||
1160 ids[i]->status == ID_UNMAPPED) {
1161 /* ok this is an unmapped one, see if we can map it */
1162 ret = idmap_new_mapping(ctx, ids[i]);
1163 if (NT_STATUS_IS_OK(ret)) {
1164 /* successfully mapped */
1165 ids[i]->status = ID_MAPPED;
1166 } else
1167 if (NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED)) {
1168 /* could not map it */
1169 ids[i]->status = ID_UNMAPPED;
1170 } else {
1171 /* Something very bad happened down there
1172 * OR we are offline */
1173 ids[i]->status = ID_UNKNOWN;
1174 }
1175 }
1176 }
1177
1178 ret = NT_STATUS_OK;
1179
1180 done:
1181 talloc_free(ctx);
1182 return ret;
1183 }
1184
1185 /**************************************************************************
1186 idmap interface functions
1187 **************************************************************************/
1188
1189 NTSTATUS idmap_unixids_to_sids(struct id_map **ids)
1190 {
1191 TALLOC_CTX *ctx;
1192 NTSTATUS ret;
1193 struct id_map **bids;
1194 int i, bi;
1195 int bn = 0;
1196
1197 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
1198 return ret;
1199 }
1200
1201 if (!ids || !*ids) {
1202 DEBUG(1, ("Invalid list of maps\n"));
1203 return NT_STATUS_INVALID_PARAMETER;
1204 }
1205
1206 ctx = talloc_named_const(NULL, 0, "idmap_unixids_to_sids ctx");
1207 if ( ! ctx) {
1208 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1209 return NT_STATUS_NO_MEMORY;
1210 }
1211
1212 /* no ids to be asked to the backends by default */
1213 bids = NULL;
1214 bi = 0;
1215
1216 for (i = 0; ids[i]; i++) {
1217
1218 if ( ! ids[i]->sid) {
1219 DEBUG(1, ("invalid null SID in id_map array"));
1220 talloc_free(ctx);
1221 return NT_STATUS_INVALID_PARAMETER;
1222 }
1223
1224 ret = idmap_cache_map_id(idmap_cache, ids[i]);
1225
1226 if ( ! NT_STATUS_IS_OK(ret)) {
1227
1228 if ( ! bids) {
1229 /* alloc space for ids to be resolved by
1230 * backends (realloc ten by ten) */
1231 bids = TALLOC_ARRAY(ctx, struct id_map *, 10);
1232 if ( ! bids) {
1233 DEBUG(1, ("Out of memory!\n"));
1234 talloc_free(ctx);
1235 return NT_STATUS_NO_MEMORY;
1236 }
1237 bn = 10;
1238 }
1239
1240 /* add this id to the ones to be retrieved
1241 * from the backends */
1242 bids[bi] = ids[i];
1243 bi++;
1244
1245 /* check if we need to allocate new space
1246 * on the rids array */
1247 if (bi == bn) {
1248 bn += 10;
1249 bids = talloc_realloc(ctx, bids,
1250 struct id_map *, bn);
1251 if ( ! bids) {
1252 DEBUG(1, ("Out of memory!\n"));
1253 talloc_free(ctx);
1254 return NT_STATUS_NO_MEMORY;
1255 }
1256 }
1257
1258 /* make sure the last element is NULL */
1259 bids[bi] = NULL;
1260 }
1261 }
1262
1263 /* let's see if there is any id mapping to be retieved
1264 * from the backends */
1265 if (bi) {
1266
1267 ret = idmap_backends_unixids_to_sids(bids);
1268 IDMAP_CHECK_RET(ret);
1269
1270 /* update the cache */
1271 for (i = 0; i < bi; i++) {
1272 if (bids[i]->status == ID_MAPPED) {
1273 ret = idmap_cache_set(idmap_cache, bids[i]);
1274 } else if (bids[i]->status == ID_EXPIRED) {
1275 /* the cache returned an expired entry and the
1276 * backend was not able to clear the situation
1277 * (offline). This handles a previous
1278 * NT_STATUS_SYNCHRONIZATION_REQUIRED
1279 * for disconnected mode, */
1280 bids[i]->status = ID_MAPPED;
1281 } else if (bids[i]->status == ID_UNKNOWN) {
1282 /* something bad here. We were not able to
1283 * handle this for some reason, mark it as
1284 * unmapped and hope next time things will
1285 * settle down. */
1286 bids[i]->status = ID_UNMAPPED;
1287 } else { /* unmapped */
1288 ret = idmap_cache_set_negative_id(idmap_cache,
1289 bids[i]);
1290 }
1291 IDMAP_CHECK_RET(ret);
1292 }
1293 }
1294
1295 ret = NT_STATUS_OK;
1296 done:
1297 talloc_free(ctx);
1298 return ret;
1299 }
1300
1301 NTSTATUS idmap_sids_to_unixids(struct id_map **ids)
1302 {
1303 TALLOC_CTX *ctx;
1304 NTSTATUS ret;
1305 struct id_map **bids;
1306 int i, bi;
1307 int bn = 0;
1308
1309 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
1310 return ret;
1311 }
1312
1313 if (!ids || !*ids) {
1314 DEBUG(1, ("Invalid list of maps\n"));
1315 return NT_STATUS_INVALID_PARAMETER;
1316 }
1317
1318 ctx = talloc_named_const(NULL, 0, "idmap_sids_to_unixids ctx");
1319 if ( ! ctx) {
1320 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1321 return NT_STATUS_NO_MEMORY;
1322 }
1323
1324 /* no ids to be asked to the backends by default */
1325 bids = NULL;
1326 bi = 0;
1327
1328 for (i = 0; ids[i]; i++) {
1329
1330 if ( ! ids[i]->sid) {
1331 DEBUG(1, ("invalid null SID in id_map array\n"));
1332 talloc_free(ctx);
1333 return NT_STATUS_INVALID_PARAMETER;
1334 }
1335
1336 ret = idmap_cache_map_sid(idmap_cache, ids[i]);
1337
1338 if ( ! NT_STATUS_IS_OK(ret)) {
1339
1340 if ( ! bids) {
1341 /* alloc space for ids to be resolved
1342 by backends (realloc ten by ten) */
1343 bids = TALLOC_ARRAY(ctx, struct id_map *, 10);
1344 if ( ! bids) {
1345 DEBUG(1, ("Out of memory!\n"));
1346 talloc_free(ctx);
1347 return NT_STATUS_NO_MEMORY;
1348 }
1349 bn = 10;
1350 }
1351
1352 /* add this id to the ones to be retrieved
1353 * from the backends */
1354 bids[bi] = ids[i];
1355 bi++;
1356
1357 /* check if we need to allocate new space
1358 * on the ids array */
1359 if (bi == bn) {
1360 bn += 10;
1361 bids = talloc_realloc(ctx, bids,
1362 struct id_map *, bn);
1363 if ( ! bids) {
1364 DEBUG(1, ("Out of memory!\n"));
1365 talloc_free(ctx);
1366 return NT_STATUS_NO_MEMORY;
1367 }
1368 }
1369
1370 /* make sure the last element is NULL */
1371 bids[bi] = NULL;
1372 }
1373 }
1374
1375 /* let's see if there is any id mapping to be retieved
1376 * from the backends */
1377 if (bids) {
1378
1379 ret = idmap_backends_sids_to_unixids(bids);
1380 IDMAP_CHECK_RET(ret);
1381
1382 /* update the cache */
1383 for (i = 0; bids[i]; i++) {
1384 if (bids[i]->status == ID_MAPPED) {
1385 ret = idmap_cache_set(idmap_cache, bids[i]);
1386 } else if (bids[i]->status == ID_EXPIRED) {
1387 /* the cache returned an expired entry and the
1388 * backend was not able to clear the situation
1389 * (offline). This handles a previous
1390 * NT_STATUS_SYNCHRONIZATION_REQUIRED
1391 * for disconnected mode, */
1392 bids[i]->status = ID_MAPPED;
1393 } else if (bids[i]->status == ID_UNKNOWN) {
1394 /* something bad here. We were not able to
1395 * handle this for some reason, mark it as
1396 * unmapped and hope next time things will
1397 * settle down. */
1398 bids[i]->status = ID_UNMAPPED;
1399 } else { /* unmapped */
1400 ret = idmap_cache_set_negative_sid(idmap_cache,
1401 bids[i]);
1402 }
1403 IDMAP_CHECK_RET(ret);
1404 }
1405 }
1406
1407 ret = NT_STATUS_OK;
1408 done:
1409 talloc_free(ctx);
1410 return ret;
1411 }
1412
1413 NTSTATUS idmap_set_mapping(const struct id_map *id)
1414 {
1415 TALLOC_CTX *ctx;
1416 NTSTATUS ret;
1417
1418 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
1419 return ret;
1420 }
1421
1422 /* sanity checks */
1423 if ((id->sid == NULL) || (id->status != ID_MAPPED)) {
1424 DEBUG(1, ("NULL SID or unmapped entry\n"));
1425 return NT_STATUS_INVALID_PARAMETER;
1426 }
1427
1428 /* TODO: check uid/gid range ? */
1429
1430 ctx = talloc_named_const(NULL, 0, "idmap_set_mapping ctx");
1431 if ( ! ctx) {
1432 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1433 return NT_STATUS_NO_MEMORY;
1434 }
1435
1436 /* set the new mapping */
1437 ret = idmap_backends_set_mapping(id);
1438 IDMAP_CHECK_RET(ret);
1439
1440 /* set the mapping in the cache */
1441 ret = idmap_cache_set(idmap_cache, id);
1442 IDMAP_CHECK_RET(ret);
1443
1444 done:
1445 talloc_free(ctx);
1446 return ret;
1447 }
1448
1449 /**************************************************************************
1450 Dump backend status.
1451 **************************************************************************/
1452
1453 void idmap_dump_maps(char *logfile)
1454 {
1455 NTSTATUS ret;
1456 struct unixid allid;
1457 struct id_map *maps;
1458 int num_maps;
1459 FILE *dump;
1460 int i;
1461
1462 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
1463 return;
1464 }
1465
1466 dump = fopen(logfile, "w");
1467 if ( ! dump) {
1468 DEBUG(0, ("Unable to open open stream for file [%s], "
1469 "errno: %d\n", logfile, errno));
1470 return;
1471 }
1472
1473 if (NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
1474 allid.type = ID_TYPE_UID;
1475 allid.id = 0;
1476 idmap_alloc_ctx->methods->get_id_hwm(&allid);
1477 fprintf(dump, "USER HWM %lu\n", (unsigned long)allid.id);
1478
1479 allid.type = ID_TYPE_GID;
1480 allid.id = 0;
1481 idmap_alloc_ctx->methods->get_id_hwm(&allid);
1482 fprintf(dump, "GROUP HWM %lu\n", (unsigned long)allid.id);
1483 }
1484
1485 maps = talloc(idmap_ctx, struct id_map);
1486 num_maps = 0;
1487
1488 for (i = 0; i < num_domains; i++) {
1489 if (idmap_domains[i]->methods->dump_data) {
1490 idmap_domains[i]->methods->dump_data(idmap_domains[i],
1491 &maps, &num_maps);
1492 }
1493 }
1494
1495 for (i = 0; i < num_maps; i++) {
1496 switch (maps[i].xid.type) {
1497 case ID_TYPE_UID:
1498 fprintf(dump, "UID %lu %s\n",
1499 (unsigned long)maps[i].xid.id,
1500 sid_string_static(maps[i].sid));
1501 break;
1502 case ID_TYPE_GID:
1503 fprintf(dump, "GID %lu %s\n",
1504 (unsigned long)maps[i].xid.id,
1505 sid_string_static(maps[i].sid));
1506 break;
1507 case ID_TYPE_NOT_SPECIFIED:
1508 break;
1509 }
1510 }
1511
1512 fflush(dump);
1513 fclose(dump);
1514 }
1515
1516 char *idmap_fetch_secret(const char *backend, bool alloc,
1517 const char *domain, const char *identity)
1518 {
1519 char *tmp, *ret;
1520 int r;
1521
1522 if (alloc) {
1523 r = asprintf(&tmp, "IDMAP_ALLOC_%s", backend);
1524 } else {
1525 r = asprintf(&tmp, "IDMAP_%s_%s", backend, domain);
1526 }
1527
1528 if (r < 0)
1529 return NULL;
1530
1531 strupper_m(tmp); /* make sure the key is case insensitive */
1532 ret = secrets_fetch_generic(tmp, identity);
1533
1534 SAFE_FREE(tmp);
1535
1536 return ret;
1537 }
1538
Samba GIT mirror