2 * Unix SMB/CIFS implementation.
4 * group mapping code on top of ldb
6 * Copyright (C) Andrew Tridgell 2006
8 * based on tdb group mapping code from groupdb/mapping.c
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 2 of the License, or
13 * (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 #include "groupdb/mapping.h"
27 #include "lib/ldb/include/includes.h"
28 #include "lib/ldb/include/ldb_errors.h"
30 static struct ldb_context
*ldb
;
32 static BOOL
mapping_upgrade(const char *tdb_path
);
35 connect to the group mapping ldb
37 static BOOL
init_group_mapping(void)
40 const char *init_ldif
[] =
41 { "dn: @ATTRIBUTES\n" \
42 "ntName: CASE_INSENSITIVE\n" \
45 "@IDXATTR: gidNumber\n" \
46 "@IDXATTR: ntName\n" \
47 "@IDXATTR: member\n" };
48 const char *db_path
, *tdb_path
;
56 /* this is needed as Samba3 doesn't have this globally yet */
59 db_path
= lock_path("group_mapping.ldb");
62 if (ldb
== NULL
) goto failed
;
64 existed
= file_exist(db_path
, NULL
);
66 if (lp_parm_bool(-1, "groupmap", "nosync", False
)) {
67 flags
|= LDB_FLG_NOSYNC
;
71 flags
|= LDB_FLG_NOMMAP
;
74 ret
= ldb_connect(ldb
, db_path
, flags
, NULL
);
75 if (ret
!= LDB_SUCCESS
) {
80 /* initialise the ldb with an index */
81 struct ldb_ldif
*ldif
;
83 for (i
=0;i
<ARRAY_SIZE(init_ldif
);i
++) {
84 ldif
= ldb_ldif_read_string(ldb
, &init_ldif
[i
]);
85 if (ldif
== NULL
) goto failed
;
86 ret
= ldb_add(ldb
, ldif
->msg
);
88 if (ret
== -1) goto failed
;
92 /* possibly upgrade */
93 tdb_path
= lock_path("group_mapping.tdb");
94 if (file_exist(tdb_path
, NULL
) && !mapping_upgrade(tdb_path
)) {
95 unlink(lock_path("group_mapping.ldb"));
102 DEBUG(0,("Failed to open group mapping ldb '%s' - '%s'\n",
103 db_path
, ldb
?ldb_errstring(ldb
):strerror(errno
)));
111 form the DN for a mapping entry from a SID
113 static struct ldb_dn
*mapping_dn(TALLOC_CTX
*mem_ctx
, const DOM_SID
*sid
)
119 sid_copy(&domsid
, sid
);
120 if (!sid_split_rid(&domsid
, &rid
)) {
123 if (!sid_to_string(string_sid
, &domsid
)) {
126 /* we split by domain and rid so we can do a subtree search
127 when we only want one domain */
128 return ldb_dn_string_compose(mem_ctx
, NULL
, "rid=%u,domain=%s",
133 add a group mapping entry
135 static BOOL
add_mapping_entry(GROUP_MAP
*map
, int flag
)
137 struct ldb_message
*msg
;
141 msg
= ldb_msg_new(ldb
);
146 msg
->dn
= mapping_dn(msg
, &map
->sid
);
147 if (msg
->dn
== NULL
) {
151 if (ldb_msg_add_string(msg
, "objectClass", "groupMap") != LDB_SUCCESS
||
152 ldb_msg_add_string(msg
, "sid",
153 sid_to_string(string_sid
, &map
->sid
)) != LDB_SUCCESS
||
154 ldb_msg_add_fmt(msg
, "gidNumber", "%u", (unsigned)map
->gid
) != LDB_SUCCESS
||
155 ldb_msg_add_fmt(msg
, "sidNameUse", "%u", (unsigned)map
->sid_name_use
) != LDB_SUCCESS
||
156 ldb_msg_add_string(msg
, "comment", map
->comment
) != LDB_SUCCESS
||
157 ldb_msg_add_string(msg
, "ntName", map
->nt_name
) != LDB_SUCCESS
) {
161 ret
= ldb_add(ldb
, msg
);
163 /* if it exists we update it. This is a hangover from the semantics the
165 if (ret
== LDB_ERR_ENTRY_ALREADY_EXISTS
) {
166 for (i
=0;i
<msg
->num_elements
;i
++) {
167 msg
->elements
[i
].flags
= LDB_FLAG_MOD_REPLACE
;
169 ret
= ldb_modify(ldb
, msg
);
174 return ret
== LDB_SUCCESS
;
182 unpack a ldb message into a GROUP_MAP structure
184 static BOOL
msg_to_group_map(struct ldb_message
*msg
, GROUP_MAP
*map
)
188 map
->gid
= ldb_msg_find_attr_as_int(msg
, "gidNumber", -1);
189 map
->sid_name_use
= ldb_msg_find_attr_as_int(msg
, "sidNameUse", -1);
190 fstrcpy(map
->nt_name
, ldb_msg_find_attr_as_string(msg
, "ntName", NULL
));
191 fstrcpy(map
->comment
, ldb_msg_find_attr_as_string(msg
, "comment", NULL
));
192 sidstr
= ldb_msg_find_attr_as_string(msg
, "sid", NULL
);
194 if (!string_to_sid(&map
->sid
, sidstr
) ||
195 map
->gid
== (gid_t
)-1 ||
196 map
->sid_name_use
== (enum lsa_SidType
)-1) {
197 DEBUG(0,("Unable to unpack group mapping\n"));
205 return a group map entry for a given sid
207 static BOOL
get_group_map_from_sid(DOM_SID sid
, GROUP_MAP
*map
)
211 struct ldb_result
*res
=NULL
;
213 dn
= mapping_dn(ldb
, &sid
);
214 if (dn
== NULL
) goto failed
;
216 ret
= ldb_search(ldb
, dn
, LDB_SCOPE_BASE
, NULL
, NULL
, &res
);
217 talloc_steal(dn
, res
);
218 if (ret
!= LDB_SUCCESS
|| res
->count
!= 1) {
222 if (!msg_to_group_map(res
->msgs
[0], map
)) goto failed
;
233 return a group map entry for a given gid
235 static BOOL
get_group_map_from_gid(gid_t gid
, GROUP_MAP
*map
)
239 struct ldb_result
*res
=NULL
;
241 expr
= talloc_asprintf(ldb
, "(&(gidNumber=%u)(objectClass=groupMap))",
243 if (expr
== NULL
) goto failed
;
245 ret
= ldb_search(ldb
, NULL
, LDB_SCOPE_SUBTREE
, expr
, NULL
, &res
);
246 talloc_steal(expr
, res
);
247 if (ret
!= LDB_SUCCESS
|| res
->count
!= 1) goto failed
;
249 if (!msg_to_group_map(res
->msgs
[0], map
)) goto failed
;
260 Return the sid and the type of the unix group.
262 static BOOL
get_group_map_from_ntname(const char *name
, GROUP_MAP
*map
)
266 struct ldb_result
*res
=NULL
;
268 expr
= talloc_asprintf(ldb
, "(&(ntName=%s)(objectClass=groupMap))", name
);
269 if (expr
== NULL
) goto failed
;
271 ret
= ldb_search(ldb
, NULL
, LDB_SCOPE_SUBTREE
, expr
, NULL
, &res
);
272 talloc_steal(expr
, res
);
273 if (ret
!= LDB_SUCCESS
|| res
->count
!= 1) goto failed
;
275 if (!msg_to_group_map(res
->msgs
[0], map
)) goto failed
;
286 Remove a group mapping entry.
288 static BOOL
group_map_remove(const DOM_SID
*sid
)
293 dn
= mapping_dn(ldb
, sid
);
297 ret
= ldb_delete(ldb
, dn
);
300 return ret
== LDB_SUCCESS
;
305 Enumerate the group mappings for a domain
307 static BOOL
enum_group_mapping(const DOM_SID
*domsid
, enum lsa_SidType sid_name_use
,
309 size_t *p_num_entries
, BOOL unix_only
)
314 struct ldb_result
*res
;
315 struct ldb_dn
*basedn
=NULL
;
318 tmp_ctx
= talloc_new(ldb
);
319 if (tmp_ctx
== NULL
) goto failed
;
321 if (sid_name_use
== SID_NAME_UNKNOWN
) {
322 expr
= talloc_asprintf(tmp_ctx
, "(&(objectClass=groupMap))");
324 expr
= talloc_asprintf(tmp_ctx
, "(&(sidNameUse=%u)(objectClass=groupMap))",
327 if (expr
== NULL
) goto failed
;
329 /* we do a subtree search on the domain */
330 if (domsid
!= NULL
) {
331 sid_to_string(name
, domsid
);
332 basedn
= ldb_dn_string_compose(tmp_ctx
, NULL
, "domain=%s", name
);
333 if (basedn
== NULL
) goto failed
;
336 ret
= ldb_search(ldb
, basedn
, LDB_SCOPE_SUBTREE
, expr
, NULL
, &res
);
337 if (ret
!= LDB_SUCCESS
) goto failed
;
342 for (i
=0;i
<res
->count
;i
++) {
343 (*pp_rmap
) = SMB_REALLOC_ARRAY((*pp_rmap
), GROUP_MAP
,
345 if (!(*pp_rmap
)) goto failed
;
347 if (!msg_to_group_map(res
->msgs
[i
], &(*pp_rmap
)[*p_num_entries
])) {
354 talloc_free(tmp_ctx
);
358 talloc_free(tmp_ctx
);
363 This operation happens on session setup, so it should better be fast. We
364 store a list of aliases a SID is member of hanging off MEMBEROF/SID.
366 static NTSTATUS
one_alias_membership(const DOM_SID
*member
,
367 DOM_SID
**sids
, size_t *num
)
369 const char *attrs
[] = {
376 struct ldb_result
*res
=NULL
;
378 NTSTATUS status
= NT_STATUS_INTERNAL_DB_CORRUPTION
;
380 if (!sid_to_string(string_sid
, member
)) {
381 return NT_STATUS_INVALID_PARAMETER
;
384 expr
= talloc_asprintf(ldb
, "(&(member=%s)(objectClass=groupMap))",
386 if (expr
== NULL
) goto failed
;
388 ret
= ldb_search(ldb
, NULL
, LDB_SCOPE_SUBTREE
, expr
, attrs
, &res
);
389 talloc_steal(expr
, res
);
390 if (ret
!= LDB_SUCCESS
) {
394 for (i
=0;i
<res
->count
;i
++) {
395 struct ldb_message_element
*el
;
396 el
= ldb_msg_find_element(res
->msgs
[i
], "sid");
397 if (el
== NULL
|| el
->num_values
!= 1) {
398 status
= NT_STATUS_INTERNAL_DB_CORRUPTION
;
401 string_to_sid(&alias
, (char *)el
->values
[0].data
);
402 if (!add_sid_to_array_unique(NULL
, &alias
, sids
, num
)) {
403 status
= NT_STATUS_NO_MEMORY
;
417 add/remove a member field
419 static NTSTATUS
modify_aliasmem(const DOM_SID
*alias
, const DOM_SID
*member
,
424 struct ldb_message msg
;
425 struct ldb_message_element el
;
430 if (!get_group_map_from_sid(*alias
, &map
)) {
431 sid_to_string(string_sid
, alias
);
432 return NT_STATUS_NO_SUCH_ALIAS
;
435 if ((map
.sid_name_use
!= SID_NAME_ALIAS
) &&
436 (map
.sid_name_use
!= SID_NAME_WKN_GRP
)) {
437 DEBUG(0,("sid_name_use=%d\n", map
.sid_name_use
));
438 return NT_STATUS_NO_SUCH_ALIAS
;
441 tmp_ctx
= talloc_new(NULL
);
442 if (tmp_ctx
== NULL
) {
443 return NT_STATUS_NO_MEMORY
;
446 msg
.dn
= mapping_dn(tmp_ctx
, alias
);
447 if (msg
.dn
== NULL
) {
448 return NT_STATUS_NO_MEMORY
;
450 msg
.num_elements
= 1;
452 el
.flags
= operation
;
453 el
.name
= talloc_strdup(tmp_ctx
, "member");
456 sid_to_string(string_sid
, member
);
457 val
.data
= (uint8_t *)string_sid
;
458 val
.length
= strlen(string_sid
);
460 ret
= ldb_modify(ldb
, &msg
);
461 talloc_free(tmp_ctx
);
463 if (ret
== LDB_ERR_NO_SUCH_OBJECT
) {
464 return NT_STATUS_NO_SUCH_ALIAS
;
467 if (operation
== LDB_FLAG_MOD_ADD
&&
468 ret
== LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS
) {
469 return NT_STATUS_MEMBER_IN_ALIAS
;
472 return (ret
== LDB_SUCCESS
? NT_STATUS_OK
: NT_STATUS_ACCESS_DENIED
);
475 static NTSTATUS
add_aliasmem(const DOM_SID
*alias
, const DOM_SID
*member
)
477 return modify_aliasmem(alias
, member
, LDB_FLAG_MOD_ADD
);
480 static NTSTATUS
del_aliasmem(const DOM_SID
*alias
, const DOM_SID
*member
)
482 return modify_aliasmem(alias
, member
, LDB_FLAG_MOD_DELETE
);
487 enumerate sids that have the given alias set in member
489 static NTSTATUS
enum_aliasmem(const DOM_SID
*alias
, DOM_SID
**sids
, size_t *num
)
491 const char *attrs
[] = {
496 struct ldb_result
*res
=NULL
;
498 struct ldb_message_element
*el
;
503 dn
= mapping_dn(ldb
, alias
);
505 return NT_STATUS_NO_MEMORY
;
508 ret
= ldb_search(ldb
, dn
, LDB_SCOPE_BASE
, NULL
, attrs
, &res
);
509 talloc_steal(dn
, res
);
510 if (ret
== LDB_SUCCESS
&& res
->count
== 0) {
514 if (ret
!= LDB_SUCCESS
) {
516 return NT_STATUS_INTERNAL_DB_CORRUPTION
;
519 el
= ldb_msg_find_element(res
->msgs
[0], "member");
522 return NT_STATUS_INTERNAL_DB_CORRUPTION
;
525 for (i
=0;i
<el
->num_values
;i
++) {
527 string_to_sid(&sid
, (const char *)el
->values
[i
].data
);
528 if (!add_sid_to_array_unique(NULL
, &sid
, sids
, num
)) {
530 return NT_STATUS_NO_MEMORY
;
539 upgrade one group mapping record from the old tdb format
541 static int upgrade_map_record(TDB_CONTEXT
*tdb_ctx
, TDB_DATA key
,
542 TDB_DATA data
, void *state
)
547 if (strncmp((char *)key
.dptr
, GROUP_PREFIX
,
548 MIN(key
.dsize
, strlen(GROUP_PREFIX
))) != 0) {
552 if (!string_to_sid(&map
.sid
, strlen(GROUP_PREFIX
) + (const char *)key
.dptr
)) {
553 DEBUG(0,("Bad sid key '%s' during upgrade\n", (const char *)key
.dptr
));
558 ret
= tdb_unpack(data
.dptr
, data
.dsize
, "ddff",
559 &map
.gid
, &map
.sid_name_use
, &map
.nt_name
, &map
.comment
);
561 DEBUG(0,("Failed to unpack group map record during upgrade\n"));
566 if (!add_mapping_entry(&map
, 0)) {
567 DEBUG(0,("Failed to add mapping entry during upgrade\n"));
576 upgrade one alias record from the old tdb format
578 static int upgrade_alias_record(TDB_CONTEXT
*tdb_ctx
, TDB_DATA key
,
579 TDB_DATA data
, void *state
)
581 const char *p
= (const char *)data
.dptr
;
585 if (strncmp((char *)key
.dptr
, MEMBEROF_PREFIX
,
586 MIN(key
.dsize
, strlen(MEMBEROF_PREFIX
))) != 0) {
590 if (!string_to_sid(&member
, strlen(MEMBEROF_PREFIX
) + (const char *)key
.dptr
)) {
591 DEBUG(0,("Bad alias key %s during upgrade\n",
592 (const char *)key
.dptr
));
596 while (next_token(&p
, string_sid
, " ", sizeof(string_sid
))) {
599 string_to_sid(&alias
, string_sid
);
600 status
= add_aliasmem(&alias
, &member
);
601 if (NT_STATUS_EQUAL(status
, NT_STATUS_NO_SUCH_ALIAS
)) {
602 DEBUG(0,("Ignoring orphaned alias record '%s'\n",
604 } else if (!NT_STATUS_IS_OK(status
)) {
605 DEBUG(0,("Failed to add alias member during upgrade - %s\n",
616 upgrade from a old style tdb
618 static BOOL
mapping_upgrade(const char *tdb_path
)
620 static TDB_CONTEXT
*tdb
;
625 tdb
= tdb_open_log(tdb_path
, 0, TDB_DEFAULT
, O_RDWR
, 0600);
626 if (tdb
== NULL
) goto failed
;
628 /* we have to do the map records first, as alias records may
630 ret
= tdb_traverse(tdb
, upgrade_map_record
, &status
);
631 if (ret
== -1 || status
== -1) goto failed
;
633 ret
= tdb_traverse(tdb
, upgrade_alias_record
, &status
);
634 if (ret
== -1 || status
== -1) goto failed
;
641 pstrcpy(old_path
, tdb_path
);
642 pstrcpy(new_path
, lock_path("group_mapping.tdb.upgraded"));
644 if (rename(old_path
, new_path
) != 0) {
645 DEBUG(0,("Failed to rename old group mapping database\n"));
651 DEBUG(0,("Failed to upgrade group mapping database\n"));
652 if (tdb
) tdb_close(tdb
);
658 static const struct mapping_backend ldb_backend
= {
659 .add_mapping_entry
= add_mapping_entry
,
660 .get_group_map_from_sid
= get_group_map_from_sid
,
661 .get_group_map_from_gid
= get_group_map_from_gid
,
662 .get_group_map_from_ntname
= get_group_map_from_ntname
,
663 .group_map_remove
= group_map_remove
,
664 .enum_group_mapping
= enum_group_mapping
,
665 .one_alias_membership
= one_alias_membership
,
666 .add_aliasmem
= add_aliasmem
,
667 .del_aliasmem
= del_aliasmem
,
668 .enum_aliasmem
= enum_aliasmem
672 initialise the ldb mapping backend
674 const struct mapping_backend
*groupdb_ldb_init(void)
676 if (!init_group_mapping()) {
677 DEBUG(0,("Failed to initialise ldb mapping backend\n"));