source/nsswitch/idmap.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    ID Mapping
   4    Copyright (C) Tim Potter 2000
   5    Copyright (C) Jim McDonough <jmcd@us.ibm.com>        2003
   6    Copyright (C) Simo Sorce 2003
   7    Copyright (C) Jeremy Allison 2006
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 2 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program; if not, write to the Free Software
  21    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22 */
  23
  24 #include "includes.h"
  25 #include "winbindd.h"
  26
  27 #undef DBGC_CLASS
  28 #define DBGC_CLASS DBGC_IDMAP
  29
  30 static_decl_idmap;
  31
  32 struct idmap_backend {
  33         const char *name;
  34         struct idmap_methods *methods;
  35         struct idmap_backend *prev, *next;
  36 };
  37
  38 struct idmap_alloc_backend {
  39         const char *name;
  40         struct idmap_alloc_methods *methods;
  41         struct idmap_alloc_backend *prev, *next;
  42 };
  43
  44 struct idmap_cache_ctx;
  45
  46 struct idmap_alloc_context {
  47         const char *params;
  48         struct idmap_alloc_methods *methods;
  49         BOOL initialized;
  50 };
  51
  52 static TALLOC_CTX *idmap_ctx = NULL;
  53 static struct idmap_cache_ctx *idmap_cache;
  54
  55 static struct idmap_backend *backends = NULL;
  56 static struct idmap_domain **idmap_domains = NULL;
  57 static int num_domains = 0;
  58 static int pdb_dom_num = -1;
  59 static int def_dom_num = -1;
  60
  61 static struct idmap_alloc_backend *alloc_backends = NULL;
  62 static struct idmap_alloc_context *idmap_alloc_ctx = NULL;
  63
  64 #define IDMAP_CHECK_RET(ret) do { if ( ! NT_STATUS_IS_OK(ret)) { DEBUG(2, ("ERROR: NTSTATUS = 0x%08x\n", NT_STATUS_V(ret))); goto done; } } while(0)
  65 #define IDMAP_REPORT_RET(ret) do { if ( ! NT_STATUS_IS_OK(ret)) { DEBUG(2, ("ERROR: NTSTATUS = 0x%08x\n", NT_STATUS_V(ret))); } } while(0)
  66 #define IDMAP_CHECK_ALLOC(mem) do { if (!mem) { DEBUG(0, ("Out of memory!\n")); ret = NT_STATUS_NO_MEMORY; goto done; } } while(0)
  67
  68 static struct idmap_methods *get_methods(struct idmap_backend *be, const char *name)
  69 {
  70         struct idmap_backend *b;
  71
  72         for (b = be; b; b = b->next) {
  73                 if (strequal(b->name, name)) {
  74                         return b->methods;
  75                 }
  76         }
  77
  78         return NULL;
  79 }
  80
  81 static struct idmap_alloc_methods *get_alloc_methods(struct idmap_alloc_backend *be, const char *name)
  82 {
  83         struct idmap_alloc_backend *b;
  84
  85         for (b = be; b; b = b->next) {
  86                 if (strequal(b->name, name)) {
  87                         return b->methods;
  88                 }
  89         }
  90
  91         return NULL;
  92 }
  93
  94 BOOL idmap_is_offline(void)
  95 {
  96         return ( lp_winbind_offline_logon() &&
  97              get_global_winbindd_state_offline() );
  98 }
  99
 100 /**********************************************************************
 101  Allow a module to register itself as a method.
 102 **********************************************************************/
 103
 104 NTSTATUS smb_register_idmap(int version, const char *name, struct idmap_methods *methods)
 105 {
 106         struct idmap_methods *test;
 107         struct idmap_backend *entry;
 108
 109         if (!idmap_ctx) {
 110                 return NT_STATUS_INTERNAL_DB_ERROR;
 111         }
 112
 113         if ((version != SMB_IDMAP_INTERFACE_VERSION)) {
 114                 DEBUG(0, ("Failed to register idmap module.\n"
 115                           "The module was compiled against SMB_IDMAP_INTERFACE_VERSION %d,\n"
 116                           "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
 117                           "Please recompile against the current version of samba!\n",
 118                           version, SMB_IDMAP_INTERFACE_VERSION));
 119                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
 120         }
 121
 122         if (!name || !name[0] || !methods) {
 123                 DEBUG(0,("Called with NULL pointer or empty name!\n"));
 124                 return NT_STATUS_INVALID_PARAMETER;
 125         }
 126
 127         test = get_methods(backends, name);
 128         if (test) {
 129                 DEBUG(0,("Idmap module %s already registered!\n", name));
 130                 return NT_STATUS_OBJECT_NAME_COLLISION;
 131         }
 132
 133         entry = talloc(idmap_ctx, struct idmap_backend);
 134         if ( ! entry) {
 135                 DEBUG(0,("Out of memory!\n"));
 136                 return NT_STATUS_NO_MEMORY;
 137         }
 138         entry->name = talloc_strdup(idmap_ctx, name);
 139         if ( ! entry->name) {
 140                 DEBUG(0,("Out of memory!\n"));
 141                 return NT_STATUS_NO_MEMORY;
 142         }
 143         entry->methods = methods;
 144
 145         DLIST_ADD(backends, entry);
 146         DEBUG(5, ("Successfully added idmap backend '%s'\n", name));
 147         return NT_STATUS_OK;
 148 }
 149
 150 /**********************************************************************
 151  Allow a module to register itself as a method.
 152 **********************************************************************/
 153
 154 NTSTATUS smb_register_idmap_alloc(int version, const char *name, struct idmap_alloc_methods *methods)
 155 {
 156         struct idmap_alloc_methods *test;
 157         struct idmap_alloc_backend *entry;
 158
 159         if (!idmap_ctx) {
 160                 return NT_STATUS_INTERNAL_DB_ERROR;
 161         }
 162
 163         if ((version != SMB_IDMAP_INTERFACE_VERSION)) {
 164                 DEBUG(0, ("Failed to register idmap alloc module.\n"
 165                           "The module was compiled against SMB_IDMAP_INTERFACE_VERSION %d,\n"
 166                           "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
 167                           "Please recompile against the current version of samba!\n",
 168                           version, SMB_IDMAP_INTERFACE_VERSION));
 169                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
 170         }
 171
 172         if (!name || !name[0] || !methods) {
 173                 DEBUG(0,("Called with NULL pointer or empty name!\n"));
 174                 return NT_STATUS_INVALID_PARAMETER;
 175         }
 176
 177         test = get_alloc_methods(alloc_backends, name);
 178         if (test) {
 179                 DEBUG(0,("idmap_alloc module %s already registered!\n", name));
 180                 return NT_STATUS_OBJECT_NAME_COLLISION;
 181         }
 182
 183         entry = talloc(idmap_ctx, struct idmap_alloc_backend);
 184         if ( ! entry) {
 185                 DEBUG(0,("Out of memory!\n"));
 186                 return NT_STATUS_NO_MEMORY;
 187         }
 188         entry->name = talloc_strdup(idmap_ctx, name);
 189         if ( ! entry->name) {
 190                 DEBUG(0,("Out of memory!\n"));
 191                 return NT_STATUS_NO_MEMORY;
 192         }
 193         entry->methods = methods;
 194
 195         DLIST_ADD(alloc_backends, entry);
 196         DEBUG(5, ("Successfully added idmap alloc backend '%s'\n", name));
 197         return NT_STATUS_OK;
 198 }
 199
 200 static int close_domain_destructor(struct idmap_domain *dom)
 201 {
 202         NTSTATUS ret;
 203
 204         ret = dom->methods->close_fn(dom);
 205         if (!NT_STATUS_IS_OK(ret)) {
 206                 DEBUG(3, ("Failed to close idmap domain [%s]!\n", dom->name));
 207         }
 208
 209         return 0;
 210 }
 211
 212 /**************************************************************************
 213  Shutdown.
 214 **************************************************************************/
 215
 216 NTSTATUS idmap_close(void)
 217 {
 218         /* close the alloc backend first before freeing idmap_ctx */
 219         if (idmap_alloc_ctx) {
 220                 idmap_alloc_ctx->methods->close_fn();
 221                 idmap_alloc_ctx->methods = NULL;
 222         }
 223         alloc_backends = NULL;
 224
 225         /* this talloc_free call will fire the talloc destructors
 226          * that will free all active backends resources */
 227         TALLOC_FREE(idmap_ctx);
 228         idmap_cache = NULL;
 229         idmap_domains = NULL;
 230         backends = NULL;
 231
 232         return NT_STATUS_OK;
 233 }
 234
 235 /**********************************************************************
 236  Initialise idmap cache and a remote backend (if configured).
 237 **********************************************************************/
 238
 239 static const char *idmap_default_domain[] = { "default domain", NULL };
 240
 241 /****************************************************************************
 242  ****************************************************************************/
 243
 244 NTSTATUS idmap_init_cache(void)
 245 {
 246         /* Always initialize the cache.  We'll have to delay initialization
 247            of backends if we are offline */
 248
 249         if ( idmap_ctx ) {
 250                 return NT_STATUS_OK;
 251         }
 252
 253         if ( (idmap_ctx = talloc_named_const(NULL, 0, "idmap_ctx")) == NULL ) {
 254                 return NT_STATUS_NO_MEMORY;
 255         }
 256
 257         if ( (idmap_cache = idmap_cache_init(idmap_ctx)) == NULL ) {
 258                 return NT_STATUS_UNSUCCESSFUL;
 259         }
 260
 261         return NT_STATUS_OK;
 262 }
 263
 264 /****************************************************************************
 265  ****************************************************************************/
 266
 267 NTSTATUS idmap_init(void)
 268 {
 269         NTSTATUS ret;
 270         static NTSTATUS idmap_init_status = NT_STATUS_UNSUCCESSFUL;
 271         struct idmap_domain *dom;
 272         char *compat_backend = NULL;
 273         char *compat_params = NULL;
 274         const char **dom_list = NULL;
 275         char *alloc_backend = NULL;
 276         BOOL default_already_defined = False;
 277         BOOL pri_dom_is_in_list = False;
 278         int compat = 0;
 279         int i;
 280
 281         ret = idmap_init_cache();
 282         if ( !NT_STATUS_IS_OK(ret) )
 283                 return ret;
 284
 285         if (NT_STATUS_IS_OK(idmap_init_status))
 286                 return NT_STATUS_OK;
 287
 288         static_init_idmap;
 289
 290         dom_list = lp_idmap_domains();
 291
 292         if ( dom_list && lp_idmap_backend() ) {
 293                 DEBUG(0, ("WARNING: idmap backend and idmap domains are "
 294                           "mutually excusive!\n"));
 295                 DEBUGADD(0,("idmap backend option will be IGNORED!\n"));
 296         } else if ( lp_idmap_backend() ) {
 297                 const char **compat_list = lp_idmap_backend();
 298                 char *p = NULL;
 299                 const char *q = NULL;
 300
 301                 compat = 1;
 302
 303                 if ( (compat_backend = talloc_strdup( idmap_ctx, *compat_list )) == NULL ) {
 304                         ret = NT_STATUS_NO_MEMORY;
 305                         goto done;
 306                 }
 307
 308                 /* strip any leading idmap_ prefix of */
 309                 if (strncmp(*compat_list, "idmap_", 6) == 0 ) {
 310                         q = *compat_list += 6;
 311                         DEBUG(0, ("WARNING: idmap backend uses obsolete and "
 312                                   "deprecated 'idmap_' prefix.\n"
 313                                   "Please replace 'idmap_%s' by '%s' in %s\n",
 314                                   q, q, dyn_CONFIGFILE));
 315                         compat_backend = talloc_strdup( idmap_ctx, q);
 316                 } else {
 317                         compat_backend = talloc_strdup( idmap_ctx, *compat_list);
 318                 }
 319
 320                 /* separate the backend and module arguements */
 321                 if ((p = strchr(compat_backend, ':')) != NULL) {
 322                         *p = '\0';
 323                         compat_params = p + 1;
 324                 }
 325         } else {
 326                 /* Back compatible: without idmap domains and explicit
 327                    idmap backend.  Taking default idmap backend: tdb */
 328
 329                 compat = 1;
 330                 compat_backend = talloc_strdup( idmap_ctx, "tdb");
 331                 compat_params = compat_backend;
 332         }
 333
 334
 335         if ( ! dom_list) {
 336                 dom_list = idmap_default_domain;
 337         }
 338
 339         /***************************
 340          * initialize idmap domains
 341          */
 342         DEBUG(1, ("Initializing idmap domains\n"));
 343
 344         for (i = 0; dom_list[i]; i++) {
 345                 const char *parm_backend;
 346                 char *config_option;
 347
 348                 /* ignore BUILTIN and local MACHINE domains */
 349                 if ( strequal(dom_list[i], "BUILTIN")
 350                      || strequal(dom_list[i], get_global_sam_name() ) )
 351                 {
 352                         DEBUG(0,("idmap_init: Ignoring invalid domain %s\n",
 353                                  dom_list[i]));
 354                         continue;
 355                 }
 356
 357                 if (strequal(dom_list[i], lp_workgroup())) {
 358                         pri_dom_is_in_list = True;
 359                 }
 360                 /* init domain */
 361
 362                 dom = talloc_zero(idmap_ctx, struct idmap_domain);
 363                 IDMAP_CHECK_ALLOC(dom);
 364
 365                 dom->name = talloc_strdup(dom, dom_list[i]);
 366                 IDMAP_CHECK_ALLOC(dom->name);
 367
 368                 config_option = talloc_asprintf(dom, "idmap config %s", dom->name);
 369                 IDMAP_CHECK_ALLOC(config_option);
 370
 371                 /* default or specific ? */
 372
 373                 dom->default_domain = lp_parm_bool(-1, config_option, "default", False);
 374
 375                 if (dom->default_domain ||
 376                     strequal(dom_list[i], idmap_default_domain[0])) {
 377
 378                         /* make sure this is set even when we match idmap_default_domain[0] */
 379                         dom->default_domain = True;
 380
 381                         if (default_already_defined) {
 382                                 DEBUG(1, ("ERROR: Multiple domains defined as default!\n"));
 383                                 ret = NT_STATUS_INVALID_PARAMETER;
 384                                 goto done;
 385                         }
 386
 387                         default_already_defined = True;
 388
 389                 }
 390
 391                 dom->readonly = lp_parm_bool(-1, config_option, "readonly", False);
 392
 393                 /* find associated backend (default: tdb) */
 394                 if (compat) {
 395                         parm_backend = talloc_strdup(idmap_ctx, compat_backend);
 396                 } else {
 397                         parm_backend = talloc_strdup(idmap_ctx,
 398                                                      lp_parm_const_string(-1, config_option, "backend", "tdb"));
 399                 }
 400                 IDMAP_CHECK_ALLOC(parm_backend);
 401
 402                 /* get the backend methods for this domain */
 403                 dom->methods = get_methods(backends, parm_backend);
 404
 405                 if ( ! dom->methods) {
 406                         ret = smb_probe_module("idmap", parm_backend);
 407                         if (NT_STATUS_IS_OK(ret)) {
 408                                 dom->methods = get_methods(backends, parm_backend);
 409                         }
 410                 }
 411                 if ( ! dom->methods) {
 412                         DEBUG(0, ("ERROR: Could not get methods for backend %s\n", parm_backend));
 413                         ret = NT_STATUS_UNSUCCESSFUL;
 414                         goto done;
 415                 }
 416
 417                 /* check the set_mapping function exists otherwise mark the module as readonly */
 418                 if ( ! dom->methods->set_mapping) {
 419                         DEBUG(5, ("Forcing to readonly, as ithis module can't store arbitrary mappings.\n"));
 420                         dom->readonly = True;
 421                 }
 422
 423                 /* now that we have methods, set the destructor for this domain */
 424                 talloc_set_destructor(dom, close_domain_destructor);
 425
 426                 if (compat_params) {
 427                         dom->params = talloc_strdup(dom, compat_params);
 428                         IDMAP_CHECK_ALLOC(dom->params);
 429                 } else {
 430                         dom->params = NULL;
 431                 }
 432
 433                 /* Finally instance a backend copy for this domain */
 434                 ret = dom->methods->init(dom);
 435                 if ( ! NT_STATUS_IS_OK(ret)) {
 436                         DEBUG(0, ("ERROR: Initialization failed for backend %s (domain %s), deferred!\n",
 437                                                 parm_backend, dom->name));
 438                 }
 439                 idmap_domains = talloc_realloc(idmap_ctx, idmap_domains, struct idmap_domain *, i+1);
 440                 if ( ! idmap_domains) {
 441                         DEBUG(0, ("Out of memory!\n"));
 442                         ret = NT_STATUS_NO_MEMORY;
 443                         goto done;
 444                 }
 445                 idmap_domains[i] = dom;
 446
 447                 if (dom->default_domain) { /* save default domain position for future uses */
 448                         def_dom_num = i;
 449                 }
 450
 451                 DEBUG(10, ("Domain %s - Backend %s - %sdefault - %sreadonly\n",
 452                                 dom->name, parm_backend,
 453                                 dom->default_domain?"":"not ", dom->readonly?"":"not "));
 454
 455                 talloc_free(config_option);
 456         }
 457
 458         /* save the number of domains we have */
 459         num_domains = i;
 460
 461         /* automatically add idmap_nss backend if needed */
 462         if ((lp_server_role() == ROLE_DOMAIN_MEMBER) &&
 463             ( ! pri_dom_is_in_list) &&
 464             lp_winbind_trusted_domains_only()) {
 465
 466                 dom = talloc_zero(idmap_ctx, struct idmap_domain);
 467                 IDMAP_CHECK_ALLOC(dom);
 468
 469                 dom->name = talloc_strdup(dom, lp_workgroup());
 470                 IDMAP_CHECK_ALLOC(dom->name);
 471
 472                 dom->default_domain = False;
 473                 dom->readonly = True;
 474
 475                 /* get the backend methods for passdb */
 476                 dom->methods = get_methods(backends, "nss");
 477
 478                 /* (the nss module is always statically linked) */
 479                 if ( ! dom->methods) {
 480                         DEBUG(0, ("ERROR: Could not get methods for idmap_nss ?!\n"));
 481                         ret = NT_STATUS_UNSUCCESSFUL;
 482                         goto done;
 483                 }
 484
 485                 /* now that we have methods, set the destructor for this domain */
 486                 talloc_set_destructor(dom, close_domain_destructor);
 487
 488                 if (compat_params) {
 489                         dom->params = talloc_strdup(dom, compat_params);
 490                         IDMAP_CHECK_ALLOC(dom->params);
 491                 } else {
 492                         dom->params = NULL;
 493                 }
 494
 495                 /* Finally instance a backend copy for this domain */
 496                 ret = dom->methods->init(dom);
 497                 if ( ! NT_STATUS_IS_OK(ret)) {
 498                         DEBUG(0, ("ERROR: Initialization failed for idmap_nss ?!\n"));
 499                         ret = NT_STATUS_UNSUCCESSFUL;
 500                         goto done;
 501                 }
 502
 503                 idmap_domains = talloc_realloc(idmap_ctx, idmap_domains, struct idmap_domain *, num_domains+1);
 504                 if ( ! idmap_domains) {
 505                         DEBUG(0, ("Out of memory!\n"));
 506                         ret = NT_STATUS_NO_MEMORY;
 507                         goto done;
 508                 }
 509                 idmap_domains[num_domains] = dom;
 510
 511                 DEBUG(10, ("Domain %s - Backend nss - not default - readonly\n", dom->name ));
 512
 513                 num_domains++;
 514         }
 515
 516         /**** automatically add idmap_passdb backend ****/
 517         dom = talloc_zero(idmap_ctx, struct idmap_domain);
 518         IDMAP_CHECK_ALLOC(dom);
 519
 520         dom->name = talloc_strdup(dom, get_global_sam_name());
 521         IDMAP_CHECK_ALLOC(dom->name);
 522
 523         dom->default_domain = False;
 524         dom->readonly = True;
 525
 526         /* get the backend methods for passdb */
 527         dom->methods = get_methods(backends, "passdb");
 528
 529         /* (the passdb module is always statically linked) */
 530         if ( ! dom->methods) {
 531                 DEBUG(0, ("ERROR: Could not get methods for idmap_passdb ?!\n"));
 532                 ret = NT_STATUS_UNSUCCESSFUL;
 533                 goto done;
 534         }
 535
 536         /* now that we have methods, set the destructor for this domain */
 537         talloc_set_destructor(dom, close_domain_destructor);
 538
 539         if (compat_params) {
 540                 dom->params = talloc_strdup(dom, compat_params);
 541                 IDMAP_CHECK_ALLOC(dom->params);
 542         } else {
 543                 dom->params = NULL;
 544         }
 545
 546         /* Finally instance a backend copy for this domain */
 547         ret = dom->methods->init(dom);
 548         if ( ! NT_STATUS_IS_OK(ret)) {
 549                 DEBUG(0, ("ERROR: Initialization failed for idmap_passdb ?!\n"));
 550                 ret = NT_STATUS_UNSUCCESSFUL;
 551                 goto done;
 552         }
 553
 554         idmap_domains = talloc_realloc(idmap_ctx, idmap_domains, struct idmap_domain *, num_domains+1);
 555         if ( ! idmap_domains) {
 556                 DEBUG(0, ("Out of memory!\n"));
 557                 ret = NT_STATUS_NO_MEMORY;
 558                 goto done;
 559         }
 560         idmap_domains[num_domains] = dom;
 561
 562         /* needed to handle special BUILTIN and wellknown SIDs cases */
 563         pdb_dom_num = num_domains;
 564
 565         DEBUG(10, ("Domain %s - Backend passdb - not default - readonly\n", dom->name));
 566
 567         num_domains++;
 568         /**** finished adding idmap_passdb backend ****/
 569
 570         /* sort domains so that the default is the last one */
 571         /* don't sort if no default domain defined */
 572         if (def_dom_num != -1 && def_dom_num != num_domains-1) { /* default is not last, move it */
 573                 struct idmap_domain *tmp;
 574
 575                 if (pdb_dom_num > def_dom_num) {
 576                         pdb_dom_num --;
 577
 578                 } else if (pdb_dom_num == def_dom_num) { /* ?? */
 579                         pdb_dom_num = num_domains - 1;
 580                 }
 581
 582                 tmp = idmap_domains[def_dom_num];
 583
 584                 for (i = def_dom_num; i < num_domains-1; i++) {
 585                         idmap_domains[i] = idmap_domains[i+1];
 586                 }
 587                 idmap_domains[i] = tmp;
 588                 def_dom_num = i;
 589         }
 590
 591
 592         /* Initialize alloc module */
 593
 594         DEBUG(3, ("Initializing idmap alloc module\n"));
 595
 596         alloc_backend = NULL;
 597         if (compat) {
 598                 alloc_backend = talloc_strdup(idmap_ctx, compat_backend);
 599         } else {
 600                 char *ab = lp_idmap_alloc_backend();
 601
 602                 if (ab && (ab[0] != '\0')) {
 603                         alloc_backend = talloc_strdup(idmap_ctx, lp_idmap_alloc_backend());
 604                 }
 605         }
 606
 607         if ( alloc_backend ) {
 608
 609                 idmap_alloc_ctx = talloc_zero(idmap_ctx, struct idmap_alloc_context);
 610                 IDMAP_CHECK_ALLOC(idmap_alloc_ctx);
 611
 612                 idmap_alloc_ctx->methods = get_alloc_methods(alloc_backends, alloc_backend);
 613                 if ( ! idmap_alloc_ctx->methods) {
 614                         ret = smb_probe_module("idmap", alloc_backend);
 615                         if (NT_STATUS_IS_OK(ret)) {
 616                                 idmap_alloc_ctx->methods = get_alloc_methods(alloc_backends, alloc_backend);
 617                         }
 618                 }
 619                 if (idmap_alloc_ctx->methods) {
 620
 621                         if (compat_params) {
 622                                 idmap_alloc_ctx->params = talloc_strdup(idmap_alloc_ctx, compat_params);
 623                                 IDMAP_CHECK_ALLOC(idmap_alloc_ctx->params);
 624                         } else {
 625                                 idmap_alloc_ctx->params = NULL;
 626                         }
 627
 628                         ret = idmap_alloc_ctx->methods->init(idmap_alloc_ctx->params);
 629                         if ( ! NT_STATUS_IS_OK(ret)) {
 630                                 DEBUG(0, ("ERROR: Initialization failed for alloc "
 631                                           "backend %s, deferred!\n", alloc_backend));
 632                         } else {
 633                                 idmap_alloc_ctx->initialized = True;
 634                         }
 635                 } else {
 636                         DEBUG(2, ("idmap_init: Unable to get methods for alloc backend %s\n",
 637                                   alloc_backend));
 638                         /* certain compat backends are just readonly */
 639                         if ( compat ) {
 640                                 TALLOC_FREE(idmap_alloc_ctx);
 641                                 ret = NT_STATUS_OK;
 642                         } else {
 643                                 ret = NT_STATUS_UNSUCCESSFUL;
 644                         }
 645                 }
 646         }
 647
 648         /* cleanpu temporary strings */
 649         TALLOC_FREE( compat_backend );
 650
 651         idmap_init_status = NT_STATUS_OK;
 652
 653         return ret;
 654
 655 done:
 656         DEBUG(0, ("Aborting IDMAP Initialization ...\n"));
 657         idmap_close();
 658
 659         return ret;
 660 }
 661
 662 static NTSTATUS idmap_alloc_init(void)
 663 {
 664         NTSTATUS ret;
 665
 666         if (! NT_STATUS_IS_OK(ret = idmap_init())) {
 667                 return ret;
 668         }
 669
 670         if ( ! idmap_alloc_ctx) {
 671                 return NT_STATUS_NOT_SUPPORTED;
 672         }
 673
 674         if ( ! idmap_alloc_ctx->initialized) {
 675                 ret = idmap_alloc_ctx->methods->init(idmap_alloc_ctx->params);
 676                 if ( ! NT_STATUS_IS_OK(ret)) {
 677                         DEBUG(0, ("ERROR: Initialization failed for alloc "
 678                                   "backend, deferred!\n"));
 679                         return ret;
 680                 } else {
 681                         idmap_alloc_ctx->initialized = True;
 682                 }
 683         }
 684
 685         return NT_STATUS_OK;
 686 }
 687
 688 /**************************************************************************
 689  idmap allocator interface functions
 690 **************************************************************************/
 691
 692 NTSTATUS idmap_allocate_uid(struct unixid *id)
 693 {
 694         NTSTATUS ret;
 695
 696         if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
 697                 return ret;
 698         }
 699
 700         id->type = ID_TYPE_UID;
 701         return idmap_alloc_ctx->methods->allocate_id(id);
 702 }
 703
 704 NTSTATUS idmap_allocate_gid(struct unixid *id)
 705 {
 706         NTSTATUS ret;
 707
 708         if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
 709                 return ret;
 710         }
 711
 712         id->type = ID_TYPE_GID;
 713         return idmap_alloc_ctx->methods->allocate_id(id);
 714 }
 715
 716 NTSTATUS idmap_set_uid_hwm(struct unixid *id)
 717 {
 718         NTSTATUS ret;
 719
 720         if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
 721                 return ret;
 722         }
 723
 724         id->type = ID_TYPE_UID;
 725         return idmap_alloc_ctx->methods->set_id_hwm(id);
 726 }
 727
 728 NTSTATUS idmap_set_gid_hwm(struct unixid *id)
 729 {
 730         NTSTATUS ret;
 731
 732         if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
 733                 return ret;
 734         }
 735
 736         id->type = ID_TYPE_GID;
 737         return idmap_alloc_ctx->methods->set_id_hwm(id);
 738 }
 739
 740 /******************************************************************************
 741  Lookup an idmap_domain give a full user or group SID
 742  ******************************************************************************/
 743
 744 static struct idmap_domain* find_idmap_domain_from_sid( DOM_SID *account_sid )
 745 {
 746         DOM_SID domain_sid;
 747         uint32 rid;
 748         struct winbindd_domain *domain = NULL;
 749         int i;
 750
 751         /* 1. Handle BUILTIN or Special SIDs and prevent them from
 752            falling into the default domain space (if we have a
 753            configured passdb backend. */
 754
 755         if ( (pdb_dom_num != -1) &&
 756              (sid_check_is_in_builtin(account_sid) ||
 757               sid_check_is_in_wellknown_domain(account_sid) ||
 758               sid_check_is_in_unix_groups(account_sid) ||
 759               sid_check_is_in_unix_users(account_sid)) )
 760         {
 761                 return idmap_domains[pdb_dom_num];
 762         }
 763
 764         /* 2. Lookup the winbindd_domain from the account_sid */
 765
 766         sid_copy( &domain_sid, account_sid );
 767         sid_split_rid( &domain_sid, &rid );
 768         domain = find_domain_from_sid_noinit( &domain_sid );
 769
 770         for (i = 0; domain && i < num_domains; i++) {
 771                 if ( strequal( idmap_domains[i]->name, domain->name ) ) {
 772                         return idmap_domains[i];
 773                 }
 774         }
 775
 776         /* 3. Fall back to the default domain */
 777
 778         if ( def_dom_num != -1 ) {
 779                 return idmap_domains[def_dom_num];
 780         }
 781
 782         return NULL;
 783 }
 784
 785 /******************************************************************************
 786  Lookup an index given an idmap_domain pointer
 787  ******************************************************************************/
 788
 789 static uint32 find_idmap_domain_index( struct idmap_domain *id_domain)
 790 {
 791         int i;
 792
 793         for (i = 0; i < num_domains; i++) {
 794                 if ( idmap_domains[i] == id_domain )
 795                         return i;
 796         }
 797
 798         return -1;
 799 }
 800
 801
 802 /*********************************************************
 803  Check if creating a mapping is permitted for the domain
 804 *********************************************************/
 805
 806 static NTSTATUS idmap_can_map(const struct id_map *map, struct idmap_domain **ret_dom)
 807 {
 808         struct idmap_domain *dom;
 809
 810         /* Check we do not create mappings for our own local domain, or BUILTIN or special SIDs */
 811         if ((sid_compare_domain(map->sid, get_global_sam_sid()) == 0) ||
 812             sid_check_is_in_builtin(map->sid) ||
 813             sid_check_is_in_wellknown_domain(map->sid)) {
 814                 DEBUG(10, ("We are not supposed to create mappings for our own domains (local, builtin, specials)\n"));
 815                 return NT_STATUS_UNSUCCESSFUL;
 816         }
 817
 818         /* Special check for trusted domain only = Yes */
 819         if (lp_winbind_trusted_domains_only()) {
 820                 struct winbindd_domain *wdom = find_our_domain();
 821                 if (wdom && (sid_compare_domain(map->sid, &wdom->sid) == 0)) {
 822                         DEBUG(10, ("We are not supposed to create mappings for our primary domain when <trusted domain only> is True\n"));
 823                         DEBUGADD(10, ("Leave [%s] unmapped\n", sid_string_static(map->sid)));
 824                         return NT_STATUS_UNSUCCESSFUL;
 825                 }
 826         }
 827
 828         if ( (dom = find_idmap_domain_from_sid( map->sid )) == NULL ) {
 829                 /* huh, couldn't find a suitable domain, let's just leave it unmapped */
 830                 DEBUG(10, ("Could not find idmap backend for SID %s", sid_string_static(map->sid)));
 831                 return NT_STATUS_NO_SUCH_DOMAIN;
 832         }
 833
 834         if (dom->readonly) {
 835                 /* ouch the domain is read only, let's just leave it unmapped */
 836                 DEBUG(10, ("idmap backend for SID %s is READONLY!\n", sid_string_static(map->sid)));
 837                 return NT_STATUS_UNSUCCESSFUL;
 838         }
 839
 840         *ret_dom = dom;
 841         return NT_STATUS_OK;
 842 }
 843
 844 static NTSTATUS idmap_new_mapping(TALLOC_CTX *ctx, struct id_map *map)
 845 {
 846         NTSTATUS ret;
 847         struct idmap_domain *dom;
 848
 849         /* If we are offline we cannot lookup SIDs, deny mapping */
 850         if (idmap_is_offline()) {
 851                 return NT_STATUS_FILE_IS_OFFLINE;
 852         }
 853
 854         ret = idmap_can_map(map, &dom);
 855         if ( ! NT_STATUS_IS_OK(ret)) {
 856                 return NT_STATUS_NONE_MAPPED;
 857         }
 858
 859         /* check if this is a valid SID and then map it */
 860         switch (map->xid.type) {
 861         case ID_TYPE_UID:
 862                 ret = idmap_allocate_uid(&map->xid);
 863                 if ( ! NT_STATUS_IS_OK(ret)) {
 864                         /* can't allocate id, let's just leave it unmapped */
 865                         DEBUG(2, ("uid allocation failed! Can't create mapping\n"));
 866                         return NT_STATUS_NONE_MAPPED;
 867                 }
 868                 break;
 869         case ID_TYPE_GID:
 870                 ret = idmap_allocate_gid(&map->xid);
 871                 if ( ! NT_STATUS_IS_OK(ret)) {
 872                         /* can't allocate id, let's just leave it unmapped */
 873                         DEBUG(2, ("gid allocation failed! Can't create mapping\n"));
 874                         return NT_STATUS_NONE_MAPPED;
 875                 }
 876                 break;
 877         default:
 878                 /* invalid sid, let's just leave it unmapped */
 879                 DEBUG(3,("idmap_new_mapping: Refusing to create a "
 880                          "mapping for an unspecified ID type.\n"));
 881                 return NT_STATUS_NONE_MAPPED;
 882         }
 883
 884         /* ok, got a new id, let's set a mapping */
 885         map->status = ID_MAPPED;
 886
 887         DEBUG(10, ("Setting mapping: %s <-> %s %lu\n",
 888                    sid_string_static(map->sid),
 889                    (map->xid.type == ID_TYPE_UID) ? "UID" : "GID",
 890                    (unsigned long)map->xid.id));
 891         ret = dom->methods->set_mapping(dom, map);
 892
 893         if ( ! NT_STATUS_IS_OK(ret)) {
 894                 /* something wrong here :-( */
 895                 DEBUG(2, ("Failed to commit mapping\n!"));
 896
 897                 /* TODO: would it make sense to have an "unalloc_id function?" */
 898
 899                 return NT_STATUS_NONE_MAPPED;
 900         }
 901
 902         return NT_STATUS_OK;
 903 }
 904
 905 static NTSTATUS idmap_backends_set_mapping(const struct id_map *map)
 906 {
 907         struct idmap_domain *dom;
 908         NTSTATUS ret;
 909
 910         DEBUG(10, ("Setting mapping %s <-> %s %lu\n",
 911                    sid_string_static(map->sid),
 912                    (map->xid.type == ID_TYPE_UID) ? "UID" : "GID",
 913                    (unsigned long)map->xid.id));
 914
 915         ret = idmap_can_map(map, &dom);
 916         if ( ! NT_STATUS_IS_OK(ret)) {
 917                 return ret;
 918         }
 919
 920         DEBUG(10,("set_mapping for domain %s\n", dom->name ));
 921
 922         return dom->methods->set_mapping(dom, map);
 923 }
 924
 925 static NTSTATUS idmap_backends_unixids_to_sids(struct id_map **ids)
 926 {
 927         struct idmap_domain *dom;
 928         struct id_map **unmapped;
 929         struct id_map **_ids;
 930         TALLOC_CTX *ctx;
 931         NTSTATUS ret;
 932         int i, u, n;
 933
 934         if (!ids || !*ids) {
 935                 DEBUG(1, ("Invalid list of maps\n"));
 936                 return NT_STATUS_INVALID_PARAMETER;
 937         }
 938
 939         ctx = talloc_named_const(NULL, 0, "idmap_backends_unixids_to_sids ctx");
 940         if ( ! ctx) {
 941                 DEBUG(0, ("Out of memory!\n"));
 942                 return NT_STATUS_NO_MEMORY;
 943         }
 944
 945         DEBUG(10, ("Query backends to map ids->sids\n"));
 946
 947         /* start from the default (the last one) and then if there are still
 948          * unmapped entries cycle through the others */
 949
 950         _ids = ids;
 951
 952         unmapped = NULL;
 953         for (n = num_domains-1; n >= 0; n--) { /* cycle backwards */
 954
 955                 dom = idmap_domains[n];
 956
 957                 DEBUG(10, ("Query sids from domain %s\n", dom->name));
 958
 959                 ret = dom->methods->unixids_to_sids(dom, _ids);
 960                 IDMAP_REPORT_RET(ret);
 961
 962                 unmapped = NULL;
 963
 964                 for (i = 0, u = 0; _ids[i]; i++) {
 965                         if (_ids[i]->status != ID_MAPPED) {
 966                                 unmapped = talloc_realloc(ctx, unmapped, struct id_map *, u + 2);
 967                                 IDMAP_CHECK_ALLOC(unmapped);
 968                                 unmapped[u] = _ids[i];
 969                                 u++;
 970                         }
 971                 }
 972                 if (unmapped) {
 973                         /* terminate the unmapped list */
 974                         unmapped[u] = NULL;
 975                 } else { /* no more entries, get out */
 976                         break;
 977                 }
 978
 979                 _ids = unmapped;
 980
 981         }
 982
 983         if (unmapped) {
 984                 /* there are still unmapped ids, map them to the unix users/groups domains */
 985                 /* except for expired entries, these will be returned as valid (offline mode) */
 986                 for (i = 0; unmapped[i]; i++) {
 987                         if (unmapped[i]->status == ID_EXPIRED) continue;
 988                         switch (unmapped[i]->xid.type) {
 989                         case ID_TYPE_UID:
 990                                 uid_to_unix_users_sid((uid_t)unmapped[i]->xid.id, unmapped[i]->sid);
 991                                 unmapped[i]->status = ID_MAPPED;
 992                                 break;
 993                         case ID_TYPE_GID:
 994                                 gid_to_unix_groups_sid((gid_t)unmapped[i]->xid.id, unmapped[i]->sid);
 995                                 unmapped[i]->status = ID_MAPPED;
 996                                 break;
 997                         default: /* what?! */
 998                                 unmapped[i]->status = ID_UNKNOWN;
 999                                 break;
1000                         }
1001                 }
1002         }
1003
1004         ret = NT_STATUS_OK;
1005
1006 done:
1007         talloc_free(ctx);
1008         return ret;
1009 }
1010
1011 static NTSTATUS idmap_backends_sids_to_unixids(struct id_map **ids)
1012 {
1013         struct id_map ***dom_ids;
1014         struct idmap_domain *dom;
1015         TALLOC_CTX *ctx;
1016         NTSTATUS ret;
1017         int i, *counters;
1018
1019         if ( (ctx = talloc_named_const(NULL, 0, "be_sids_to_ids")) == NULL ) {
1020                 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1021                 return NT_STATUS_NO_MEMORY;
1022         }
1023
1024         DEBUG(10, ("Query backends to map sids->ids\n"));
1025
1026         /* split list per domain */
1027
1028         dom_ids = talloc_zero_array(ctx, struct id_map **, num_domains);
1029         IDMAP_CHECK_ALLOC(dom_ids);
1030         counters = talloc_zero_array(ctx, int, num_domains);
1031
1032         /* partition the requests by domain */
1033
1034         for (i = 0; ids[i]; i++) {
1035                 uint32 idx;
1036
1037                 if ( (dom = find_idmap_domain_from_sid( ids[i]->sid )) == NULL ) {
1038                         /* no available idmap_domain.  Move on */
1039                         continue;
1040                 }
1041
1042                 DEBUG(10,("SID %s is being handled by %s\n",
1043                           sid_string_static(ids[i]->sid),
1044                           dom ? dom->name : "none" ));
1045
1046                 idx = find_idmap_domain_index( dom );
1047                 SMB_ASSERT( idx != -1 );
1048
1049                 dom_ids[idx] = talloc_realloc(ctx, dom_ids[idx],
1050                                               struct id_map *, counters[idx] + 2);
1051                 IDMAP_CHECK_ALLOC(dom_ids[idx]);
1052
1053                 dom_ids[idx][counters[idx]] = ids[i];
1054                 counters[idx]++;
1055                 dom_ids[idx][counters[idx]] = NULL;
1056         }
1057
1058         /* All the ids have been dispatched in the right queues.
1059            Let's cycle through the filled ones */
1060
1061         for (i = 0; i < num_domains; i++) {
1062                 if (dom_ids[i]) {
1063                         dom = idmap_domains[i];
1064                         DEBUG(10, ("Query ids from domain %s\n", dom->name));
1065                         ret = dom->methods->sids_to_unixids(dom, dom_ids[i]);
1066                         IDMAP_REPORT_RET(ret);
1067                 }
1068         }
1069
1070         /* ok all the backends have been contacted at this point */
1071         /* let's see if we have any unmapped SID left and act accordingly */
1072
1073         for (i = 0; ids[i]; i++) {
1074                 /* NOTE: this will NOT touch ID_EXPIRED entries that the backend
1075                  * was not able to confirm/deny (offline mode) */
1076                 if (ids[i]->status == ID_UNKNOWN || ids[i]->status == ID_UNMAPPED) {
1077                         /* ok this is an unmapped one, see if we can map it */
1078                         ret = idmap_new_mapping(ctx, ids[i]);
1079                         if (NT_STATUS_IS_OK(ret)) {
1080                                 /* successfully mapped */
1081                                 ids[i]->status = ID_MAPPED;
1082                         } else if (NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED)) {
1083                                 /* could not map it */
1084                                 ids[i]->status = ID_UNMAPPED;
1085                         } else {
1086                                 /* Something very bad happened down there
1087                                  * OR we are offline */
1088                                 ids[i]->status = ID_UNKNOWN;
1089                         }
1090                 }
1091         }
1092
1093         ret = NT_STATUS_OK;
1094
1095 done:
1096         talloc_free(ctx);
1097         return ret;
1098 }
1099
1100 /**************************************************************************
1101  idmap interface functions
1102 **************************************************************************/
1103
1104 NTSTATUS idmap_unixids_to_sids(struct id_map **ids)
1105 {
1106         TALLOC_CTX *ctx;
1107         NTSTATUS ret;
1108         struct id_map **bids;
1109         int i, bi;
1110         int bn = 0;
1111
1112         if (! NT_STATUS_IS_OK(ret = idmap_init())) {
1113                 return ret;
1114         }
1115
1116         if (!ids || !*ids) {
1117                 DEBUG(1, ("Invalid list of maps\n"));
1118                 return NT_STATUS_INVALID_PARAMETER;
1119         }
1120
1121         ctx = talloc_named_const(NULL, 0, "idmap_unixids_to_sids ctx");
1122         if ( ! ctx) {
1123                 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1124                 return NT_STATUS_NO_MEMORY;
1125         }
1126
1127         /* no ids to be asked to the backends by default */
1128         bids = NULL;
1129         bi = 0;
1130
1131         for (i = 0; ids[i]; i++) {
1132
1133                 if ( ! ids[i]->sid) {
1134                         DEBUG(1, ("invalid null SID in id_map array"));
1135                         talloc_free(ctx);
1136                         return NT_STATUS_INVALID_PARAMETER;
1137                 }
1138
1139                 ret = idmap_cache_map_id(idmap_cache, ids[i]);
1140
1141                 if ( ! NT_STATUS_IS_OK(ret)) {
1142
1143                         if ( ! bids) {
1144                                 /* alloc space for ids to be resolved by backends (realloc ten by ten) */
1145                                 bids = talloc_array(ctx, struct id_map *, 10);
1146                                 if ( ! bids) {
1147                                         DEBUG(1, ("Out of memory!\n"));
1148                                         talloc_free(ctx);
1149                                         return NT_STATUS_NO_MEMORY;
1150                                 }
1151                                 bn = 10;
1152                         }
1153
1154                         /* add this id to the ones to be retrieved from the backends */
1155                         bids[bi] = ids[i];
1156                         bi++;
1157
1158                         /* check if we need to allocate new space on the rids array */
1159                         if (bi == bn) {
1160                                 bn += 10;
1161                                 bids = talloc_realloc(ctx, bids, struct id_map *, bn);
1162                                 if ( ! bids) {
1163                                         DEBUG(1, ("Out of memory!\n"));
1164                                         talloc_free(ctx);
1165                                         return NT_STATUS_NO_MEMORY;
1166                                 }
1167                         }
1168
1169                         /* make sure the last element is NULL */
1170                         bids[bi] = NULL;
1171                 }
1172         }
1173
1174         /* let's see if there is any id mapping to be retieved from the backends */
1175         if (bi) {
1176
1177                 ret = idmap_backends_unixids_to_sids(bids);
1178                 IDMAP_CHECK_RET(ret);
1179
1180                 /* update the cache */
1181                 for (i = 0; i < bi; i++) {
1182                         if (bids[i]->status == ID_MAPPED) {
1183                                 ret = idmap_cache_set(idmap_cache, bids[i]);
1184                         } else if (bids[i]->status == ID_EXPIRED) {
1185                                 /* the cache returned an expired entry and the backend was
1186                                  * was not able to clear the situation (offline).
1187                                  * This handles a previous NT_STATUS_SYNCHRONIZATION_REQUIRED
1188                                  * for disconnected mode, */
1189                                 bids[i]->status = ID_MAPPED;
1190                         } else if (bids[i]->status == ID_UNKNOWN) {
1191                                 /* something bad here. We were not able to handle this for some
1192                                  * reason, mark it as unmapped and hope next time things will
1193                                  * settle down. */
1194                                 bids[i]->status = ID_UNMAPPED;
1195                         } else { /* unmapped */
1196                                 ret = idmap_cache_set_negative_id(idmap_cache, bids[i]);
1197                         }
1198                         IDMAP_CHECK_RET(ret);
1199                 }
1200         }
1201
1202         ret = NT_STATUS_OK;
1203 done:
1204         talloc_free(ctx);
1205         return ret;
1206 }
1207
1208 NTSTATUS idmap_sids_to_unixids(struct id_map **ids)
1209 {
1210         TALLOC_CTX *ctx;
1211         NTSTATUS ret;
1212         struct id_map **bids;
1213         int i, bi;
1214         int bn = 0;
1215
1216         if (! NT_STATUS_IS_OK(ret = idmap_init())) {
1217                 return ret;
1218         }
1219
1220         if (!ids || !*ids) {
1221                 DEBUG(1, ("Invalid list of maps\n"));
1222                 return NT_STATUS_INVALID_PARAMETER;
1223         }
1224
1225         ctx = talloc_named_const(NULL, 0, "idmap_sids_to_unixids ctx");
1226         if ( ! ctx) {
1227                 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1228                 return NT_STATUS_NO_MEMORY;
1229         }
1230
1231         /* no ids to be asked to the backends by default */
1232         bids = NULL;
1233         bi = 0;
1234
1235         for (i = 0; ids[i]; i++) {
1236
1237                 if ( ! ids[i]->sid) {
1238                         DEBUG(1, ("invalid null SID in id_map array\n"));
1239                         talloc_free(ctx);
1240                         return NT_STATUS_INVALID_PARAMETER;
1241                 }
1242
1243                 ret = idmap_cache_map_sid(idmap_cache, ids[i]);
1244
1245                 if ( ! NT_STATUS_IS_OK(ret)) {
1246
1247                         if ( ! bids) {
1248                                 /* alloc space for ids to be resolved
1249                                    by backends (realloc ten by ten) */
1250                                 bids = talloc_array(ctx, struct id_map *, 10);
1251                                 if ( ! bids) {
1252                                         DEBUG(1, ("Out of memory!\n"));
1253                                         talloc_free(ctx);
1254                                         return NT_STATUS_NO_MEMORY;
1255                                 }
1256                                 bn = 10;
1257                         }
1258
1259                         /* add this id to the ones to be retrieved from the backends */
1260                         bids[bi] = ids[i];
1261                         bi++;
1262
1263                         /* check if we need to allocate new space on the ids array */
1264                         if (bi == bn) {
1265                                 bn += 10;
1266                                 bids = talloc_realloc(ctx, bids, struct id_map *, bn);
1267                                 if ( ! bids) {
1268                                         DEBUG(1, ("Out of memory!\n"));
1269                                         talloc_free(ctx);
1270                                         return NT_STATUS_NO_MEMORY;
1271                                 }
1272                         }
1273
1274                         /* make sure the last element is NULL */
1275                         bids[bi] = NULL;
1276                 }
1277         }
1278
1279         /* let's see if there is any id mapping to be retieved from the backends */
1280         if (bids) {
1281
1282                 ret = idmap_backends_sids_to_unixids(bids);
1283                 IDMAP_CHECK_RET(ret);
1284
1285                 /* update the cache */
1286                 for (i = 0; bids[i]; i++) {
1287                         if (bids[i]->status == ID_MAPPED) {
1288                                 ret = idmap_cache_set(idmap_cache, bids[i]);
1289                         } else if (bids[i]->status == ID_EXPIRED) {
1290                                 /* the cache returned an expired entry and the backend was
1291                                  * was not able to clear the situation (offline).
1292                                  * This handles a previous NT_STATUS_SYNCHRONIZATION_REQUIRED
1293                                  * for disconnected mode, */
1294                                 bids[i]->status = ID_MAPPED;
1295                         } else if (bids[i]->status == ID_UNKNOWN) {
1296                                 /* something bad here. We were not able to handle this for some
1297                                  * reason, mark it as unmapped and hope next time things will
1298                                  * settle down. */
1299                                 bids[i]->status = ID_UNMAPPED;
1300                         } else { /* unmapped */
1301                                 ret = idmap_cache_set_negative_sid(idmap_cache, bids[i]);
1302                         }
1303                         IDMAP_CHECK_RET(ret);
1304                 }
1305         }
1306
1307         ret = NT_STATUS_OK;
1308 done:
1309         talloc_free(ctx);
1310         return ret;
1311 }
1312
1313 NTSTATUS idmap_set_mapping(const struct id_map *id)
1314 {
1315         TALLOC_CTX *ctx;
1316         NTSTATUS ret;
1317
1318         if (! NT_STATUS_IS_OK(ret = idmap_init())) {
1319                 return ret;
1320         }
1321
1322         /* sanity checks */
1323         if ((id->sid == NULL) || (id->status != ID_MAPPED)) {
1324                 DEBUG(1, ("NULL SID or unmapped entry\n"));
1325                 return NT_STATUS_INVALID_PARAMETER;
1326         }
1327
1328         /* TODO: check uid/gid range ? */
1329
1330         ctx = talloc_named_const(NULL, 0, "idmap_set_mapping ctx");
1331         if ( ! ctx) {
1332                 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1333                 return NT_STATUS_NO_MEMORY;
1334         }
1335
1336         /* set the new mapping */
1337         ret = idmap_backends_set_mapping(id);
1338         IDMAP_CHECK_RET(ret);
1339
1340         /* set the mapping in the cache */
1341         ret = idmap_cache_set(idmap_cache, id);
1342         IDMAP_CHECK_RET(ret);
1343
1344 done:
1345         talloc_free(ctx);
1346         return ret;
1347 }
1348
1349 /**************************************************************************
1350  Dump backend status.
1351 **************************************************************************/
1352
1353 void idmap_dump_maps(char *logfile)
1354 {
1355         NTSTATUS ret;
1356         struct unixid allid;
1357         struct id_map *maps;
1358         int num_maps;
1359         FILE *dump;
1360         int i;
1361
1362         if (! NT_STATUS_IS_OK(ret = idmap_init())) {
1363                 return;
1364         }
1365
1366         dump = fopen(logfile, "w");
1367         if ( ! dump) {
1368                 DEBUG(0, ("Unable to open open stream for file [%s], errno: %d\n", logfile, errno));
1369                 return;
1370         }
1371
1372         if (NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
1373                 allid.type = ID_TYPE_UID;
1374                 allid.id = 0;
1375                 idmap_alloc_ctx->methods->get_id_hwm(&allid);
1376                 fprintf(dump, "USER HWM %lu\n", (unsigned long)allid.id);
1377
1378                 allid.type = ID_TYPE_GID;
1379                 allid.id = 0;
1380                 idmap_alloc_ctx->methods->get_id_hwm(&allid);
1381                 fprintf(dump, "GROUP HWM %lu\n", (unsigned long)allid.id);
1382         }
1383
1384         maps = talloc(idmap_ctx, struct id_map);
1385         num_maps = 0;
1386
1387         for (i = 0; i < num_domains; i++) {
1388                 if (idmap_domains[i]->methods->dump_data) {
1389                         idmap_domains[i]->methods->dump_data(idmap_domains[i], &maps, &num_maps);
1390                 }
1391         }
1392
1393         for (i = 0; i < num_maps; i++) {
1394                 switch (maps[i].xid.type) {
1395                 case ID_TYPE_UID:
1396                         fprintf(dump, "UID %lu %s\n",
1397                                 (unsigned long)maps[i].xid.id,
1398                                 sid_string_static(maps[i].sid));
1399                         break;
1400                 case ID_TYPE_GID:
1401                         fprintf(dump, "GID %lu %s\n",
1402                                 (unsigned long)maps[i].xid.id,
1403                                 sid_string_static(maps[i].sid));
1404                         break;
1405                 case ID_TYPE_NOT_SPECIFIED:
1406                         break;
1407                 }
1408         }
1409
1410         fflush(dump);
1411         fclose(dump);
1412 }
1413
1414 char *idmap_fetch_secret(const char *backend, bool alloc,
1415                                const char *domain, const char *identity)
1416 {
1417         char *tmp, *ret;
1418         int r;
1419
1420         if (alloc) {
1421                 r = asprintf(&tmp, "IDMAP_ALLOC_%s", backend);
1422         } else {
1423                 r = asprintf(&tmp, "IDMAP_%s_%s", backend, domain);
1424         }
1425
1426         if (r < 0)
1427                 return NULL;
1428
1429         strupper_m(tmp); /* make sure the key is case insensitive */
1430         ret = secrets_fetch_generic(tmp, identity);
1431
1432         SAFE_FREE( tmp );
1433
1434         return ret;
1435 }
1436