source/winbindd/idmap_ldap.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    idmap LDAP backend
   5
   6    Copyright (C) Tim Potter             2000
   7    Copyright (C) Jim McDonough <jmcd@us.ibm.com>        2003
   8    Copyright (C) Gerald Carter          2003
   9    Copyright (C) Simo Sorce             2003-2007
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 */
  24
  25 #include "includes.h"
  26 #include "winbindd.h"
  27
  28 #undef DBGC_CLASS
  29 #define DBGC_CLASS DBGC_IDMAP
  30
  31 #include <lber.h>
  32 #include <ldap.h>
  33
  34 #include "smbldap.h"
  35
  36 static char *idmap_fetch_secret(const char *backend, bool alloc,
  37                                 const char *domain, const char *identity)
  38 {
  39         char *tmp, *ret;
  40         int r;
  41
  42         if (alloc) {
  43                 r = asprintf(&tmp, "IDMAP_ALLOC_%s", backend);
  44         } else {
  45                 r = asprintf(&tmp, "IDMAP_%s_%s", backend, domain);
  46         }
  47
  48         if (r < 0)
  49                 return NULL;
  50
  51         strupper_m(tmp); /* make sure the key is case insensitive */
  52         ret = secrets_fetch_generic(tmp, identity);
  53
  54         SAFE_FREE(tmp);
  55
  56         return ret;
  57 }
  58
  59 struct idmap_ldap_context {
  60         struct smbldap_state *smbldap_state;
  61         char *url;
  62         char *suffix;
  63         char *user_dn;
  64         uint32_t filter_low_id, filter_high_id;         /* Filter range */
  65         bool anon;
  66 };
  67
  68 struct idmap_ldap_alloc_context {
  69         struct smbldap_state *smbldap_state;
  70         char *url;
  71         char *suffix;
  72         char *user_dn;
  73         uid_t low_uid, high_uid;      /* Range of uids */
  74         gid_t low_gid, high_gid;      /* Range of gids */
  75
  76 };
  77
  78 #define CHECK_ALLOC_DONE(mem) do { \
  79         if (!mem) { \
  80                 DEBUG(0, ("Out of memory!\n")); \
  81                 ret = NT_STATUS_NO_MEMORY; \
  82                 goto done; \
  83         } } while (0)
  84
  85 /**********************************************************************
  86  IDMAP ALLOC TDB BACKEND
  87 **********************************************************************/
  88
  89 static struct idmap_ldap_alloc_context *idmap_alloc_ldap;
  90
  91 /*********************************************************************
  92  ********************************************************************/
  93
  94 static NTSTATUS get_credentials( TALLOC_CTX *mem_ctx,
  95                                  struct smbldap_state *ldap_state,
  96                                  const char *config_option,
  97                                  struct idmap_domain *dom,
  98                                  char **dn )
  99 {
 100         NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
 101         char *secret = NULL;
 102         const char *tmp = NULL;
 103         char *user_dn = NULL;
 104         bool anon = False;
 105
 106         /* assume anonymous if we don't have a specified user */
 107
 108         tmp = lp_parm_const_string(-1, config_option, "ldap_user_dn", NULL);
 109
 110         if ( tmp ) {
 111                 if (!dom) {
 112                         /* only the alloc backend can pass in a NULL dom */
 113                         secret = idmap_fetch_secret("ldap", True,
 114                                                     NULL, tmp);
 115                 } else {
 116                         secret = idmap_fetch_secret("ldap", False,
 117                                                     dom->name, tmp);
 118                 }
 119
 120                 if (!secret) {
 121                         DEBUG(0, ("get_credentials: Unable to fetch "
 122                                   "auth credentials for %s in %s\n",
 123                                   tmp, (dom==NULL)?"ALLOC":dom->name));
 124                         ret = NT_STATUS_ACCESS_DENIED;
 125                         goto done;
 126                 }
 127                 *dn = talloc_strdup(mem_ctx, tmp);
 128                 CHECK_ALLOC_DONE(*dn);
 129         } else {
 130                 if (!fetch_ldap_pw(&user_dn, &secret)) {
 131                         DEBUG(2, ("get_credentials: Failed to lookup ldap "
 132                                   "bind creds. Using anonymous connection.\n"));
 133                         anon = True;
 134                 } else {
 135                         *dn = talloc_strdup(mem_ctx, user_dn);
 136                         SAFE_FREE( user_dn );
 137                         CHECK_ALLOC_DONE(*dn);
 138                 }
 139         }
 140
 141         smbldap_set_creds(ldap_state, anon, *dn, secret);
 142         ret = NT_STATUS_OK;
 143
 144 done:
 145         SAFE_FREE(secret);
 146
 147         return ret;
 148 }
 149
 150
 151 /**********************************************************************
 152  Verify the sambaUnixIdPool entry in the directory.
 153 **********************************************************************/
 154
 155 static NTSTATUS verify_idpool(void)
 156 {
 157         NTSTATUS ret;
 158         TALLOC_CTX *ctx;
 159         LDAPMessage *result = NULL;
 160         LDAPMod **mods = NULL;
 161         const char **attr_list;
 162         char *filter;
 163         int count;
 164         int rc;
 165
 166         if ( ! idmap_alloc_ldap) {
 167                 return NT_STATUS_UNSUCCESSFUL;
 168         }
 169
 170         ctx = talloc_new(idmap_alloc_ldap);
 171         if ( ! ctx) {
 172                 DEBUG(0, ("Out of memory!\n"));
 173                 return NT_STATUS_NO_MEMORY;
 174         }
 175
 176         filter = talloc_asprintf(ctx, "(objectclass=%s)", LDAP_OBJ_IDPOOL);
 177         CHECK_ALLOC_DONE(filter);
 178
 179         attr_list = get_attr_list(ctx, idpool_attr_list);
 180         CHECK_ALLOC_DONE(attr_list);
 181
 182         rc = smbldap_search(idmap_alloc_ldap->smbldap_state,
 183                                 idmap_alloc_ldap->suffix,
 184                                 LDAP_SCOPE_SUBTREE,
 185                                 filter,
 186                                 attr_list,
 187                                 0,
 188                                 &result);
 189
 190         if (rc != LDAP_SUCCESS) {
 191                 DEBUG(1, ("Unable to verify the idpool, "
 192                           "cannot continue initialization!\n"));
 193                 return NT_STATUS_UNSUCCESSFUL;
 194         }
 195
 196         count = ldap_count_entries(idmap_alloc_ldap->smbldap_state->ldap_struct,
 197                                    result);
 198
 199         ldap_msgfree(result);
 200
 201         if ( count > 1 ) {
 202                 DEBUG(0,("Multiple entries returned from %s (base == %s)\n",
 203                         filter, idmap_alloc_ldap->suffix));
 204                 ret = NT_STATUS_UNSUCCESSFUL;
 205                 goto done;
 206         }
 207         else if (count == 0) {
 208                 char *uid_str, *gid_str;
 209
 210                 uid_str = talloc_asprintf(ctx, "%lu",
 211                                 (unsigned long)idmap_alloc_ldap->low_uid);
 212                 gid_str = talloc_asprintf(ctx, "%lu",
 213                                 (unsigned long)idmap_alloc_ldap->low_gid);
 214
 215                 smbldap_set_mod(&mods, LDAP_MOD_ADD,
 216                                 "objectClass", LDAP_OBJ_IDPOOL);
 217                 smbldap_set_mod(&mods, LDAP_MOD_ADD,
 218                                 get_attr_key2string(idpool_attr_list,
 219                                                     LDAP_ATTR_UIDNUMBER),
 220                                 uid_str);
 221                 smbldap_set_mod(&mods, LDAP_MOD_ADD,
 222                                 get_attr_key2string(idpool_attr_list,
 223                                                     LDAP_ATTR_GIDNUMBER),
 224                                 gid_str);
 225                 if (mods) {
 226                         rc = smbldap_modify(idmap_alloc_ldap->smbldap_state,
 227                                                 idmap_alloc_ldap->suffix,
 228                                                 mods);
 229                         ldap_mods_free(mods, True);
 230                 } else {
 231                         ret = NT_STATUS_UNSUCCESSFUL;
 232                         goto done;
 233                 }
 234         }
 235
 236         ret = (rc == LDAP_SUCCESS)?NT_STATUS_OK:NT_STATUS_UNSUCCESSFUL;
 237 done:
 238         talloc_free(ctx);
 239         return ret;
 240 }
 241
 242 /*****************************************************************************
 243  Initialise idmap database.
 244 *****************************************************************************/
 245
 246 static NTSTATUS idmap_ldap_alloc_init(const char *params)
 247 {
 248         NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
 249         const char *tmp;
 250         uid_t low_uid = 0;
 251         uid_t high_uid = 0;
 252         gid_t low_gid = 0;
 253         gid_t high_gid = 0;
 254
 255         /* Only do init if we are online */
 256         if (idmap_is_offline()) {
 257                 return NT_STATUS_FILE_IS_OFFLINE;
 258         }
 259
 260         idmap_alloc_ldap = TALLOC_ZERO_P(NULL, struct idmap_ldap_alloc_context);
 261         CHECK_ALLOC_DONE( idmap_alloc_ldap );
 262
 263         /* load ranges */
 264
 265         if (!lp_idmap_uid(&low_uid, &high_uid)
 266             || !lp_idmap_gid(&low_gid, &high_gid)) {
 267                 DEBUG(1, ("idmap uid or idmap gid missing\n"));
 268                 ret = NT_STATUS_UNSUCCESSFUL;
 269                 goto done;
 270         }
 271
 272         idmap_alloc_ldap->low_uid = low_uid;
 273         idmap_alloc_ldap->high_uid = high_uid;
 274         idmap_alloc_ldap->low_gid = low_gid;
 275         idmap_alloc_ldap->high_gid= high_gid;
 276
 277         if (idmap_alloc_ldap->high_uid <= idmap_alloc_ldap->low_uid) {
 278                 DEBUG(1, ("idmap uid range invalid\n"));
 279                 DEBUGADD(1, ("idmap will be unable to map foreign SIDs\n"));
 280                 ret = NT_STATUS_UNSUCCESSFUL;
 281                 goto done;
 282         }
 283
 284         if (idmap_alloc_ldap->high_gid <= idmap_alloc_ldap->low_gid) {
 285                 DEBUG(1, ("idmap gid range invalid\n"));
 286                 DEBUGADD(1, ("idmap will be unable to map foreign SIDs\n"));
 287                 ret = NT_STATUS_UNSUCCESSFUL;
 288                 goto done;
 289         }
 290
 291         if (params && *params) {
 292                 /* assume location is the only parameter */
 293                 idmap_alloc_ldap->url = talloc_strdup(idmap_alloc_ldap, params);
 294         } else {
 295                 tmp = lp_parm_const_string(-1, "idmap alloc config",
 296                                            "ldap_url", NULL);
 297
 298                 if ( ! tmp) {
 299                         DEBUG(1, ("ERROR: missing idmap ldap url\n"));
 300                         ret = NT_STATUS_UNSUCCESSFUL;
 301                         goto done;
 302                 }
 303
 304                 idmap_alloc_ldap->url = talloc_strdup(idmap_alloc_ldap, tmp);
 305         }
 306         CHECK_ALLOC_DONE( idmap_alloc_ldap->url );
 307
 308         tmp = lp_parm_const_string(-1, "idmap alloc config",
 309                                    "ldap_base_dn", NULL);
 310         if ( ! tmp || ! *tmp) {
 311                 tmp = lp_ldap_idmap_suffix();
 312                 if ( ! tmp) {
 313                         DEBUG(1, ("ERROR: missing idmap ldap suffix\n"));
 314                         ret = NT_STATUS_UNSUCCESSFUL;
 315                         goto done;
 316                 }
 317         }
 318
 319         idmap_alloc_ldap->suffix = talloc_strdup(idmap_alloc_ldap, tmp);
 320         CHECK_ALLOC_DONE( idmap_alloc_ldap->suffix );
 321
 322         ret = smbldap_init(idmap_alloc_ldap, winbind_event_context(),
 323                            idmap_alloc_ldap->url,
 324                            &idmap_alloc_ldap->smbldap_state);
 325         if (!NT_STATUS_IS_OK(ret)) {
 326                 DEBUG(1, ("ERROR: smbldap_init (%s) failed!\n",
 327                           idmap_alloc_ldap->url));
 328                 goto done;
 329         }
 330
 331         ret = get_credentials( idmap_alloc_ldap,
 332                                idmap_alloc_ldap->smbldap_state,
 333                                "idmap alloc config", NULL,
 334                                &idmap_alloc_ldap->user_dn );
 335         if ( !NT_STATUS_IS_OK(ret) ) {
 336                 DEBUG(1,("idmap_ldap_alloc_init: Failed to get connection "
 337                          "credentials (%s)\n", nt_errstr(ret)));
 338                 goto done;
 339         }
 340
 341         /* see if the idmap suffix and sub entries exists */
 342
 343         ret = verify_idpool();
 344
 345  done:
 346         if ( !NT_STATUS_IS_OK( ret ) )
 347                 TALLOC_FREE( idmap_alloc_ldap );
 348
 349         return ret;
 350 }
 351
 352 /********************************
 353  Allocate a new uid or gid
 354 ********************************/
 355
 356 static NTSTATUS idmap_ldap_allocate_id(struct unixid *xid)
 357 {
 358         TALLOC_CTX *ctx;
 359         NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
 360         int rc = LDAP_SERVER_DOWN;
 361         int count = 0;
 362         LDAPMessage *result = NULL;
 363         LDAPMessage *entry = NULL;
 364         LDAPMod **mods = NULL;
 365         char *id_str;
 366         char *new_id_str;
 367         char *filter = NULL;
 368         const char *dn = NULL;
 369         const char **attr_list;
 370         const char *type;
 371
 372         /* Only do query if we are online */
 373         if (idmap_is_offline()) {
 374                 return NT_STATUS_FILE_IS_OFFLINE;
 375         }
 376
 377         if ( ! idmap_alloc_ldap) {
 378                 return NT_STATUS_UNSUCCESSFUL;
 379         }
 380
 381         ctx = talloc_new(idmap_alloc_ldap);
 382         if ( ! ctx) {
 383                 DEBUG(0, ("Out of memory!\n"));
 384                 return NT_STATUS_NO_MEMORY;
 385         }
 386
 387         /* get type */
 388         switch (xid->type) {
 389
 390         case ID_TYPE_UID:
 391                 type = get_attr_key2string(idpool_attr_list,
 392                                            LDAP_ATTR_UIDNUMBER);
 393                 break;
 394
 395         case ID_TYPE_GID:
 396                 type = get_attr_key2string(idpool_attr_list,
 397                                            LDAP_ATTR_GIDNUMBER);
 398                 break;
 399
 400         default:
 401                 DEBUG(2, ("Invalid ID type (0x%x)\n", xid->type));
 402                 return NT_STATUS_INVALID_PARAMETER;
 403         }
 404
 405         filter = talloc_asprintf(ctx, "(objectClass=%s)", LDAP_OBJ_IDPOOL);
 406         CHECK_ALLOC_DONE(filter);
 407
 408         attr_list = get_attr_list(ctx, idpool_attr_list);
 409         CHECK_ALLOC_DONE(attr_list);
 410
 411         DEBUG(10, ("Search of the id pool (filter: %s)\n", filter));
 412
 413         rc = smbldap_search(idmap_alloc_ldap->smbldap_state,
 414                                 idmap_alloc_ldap->suffix,
 415                                LDAP_SCOPE_SUBTREE, filter,
 416                                attr_list, 0, &result);
 417
 418         if (rc != LDAP_SUCCESS) {
 419                 DEBUG(0,("%s object not found\n", LDAP_OBJ_IDPOOL));
 420                 goto done;
 421         }
 422
 423         talloc_autofree_ldapmsg(ctx, result);
 424
 425         count = ldap_count_entries(idmap_alloc_ldap->smbldap_state->ldap_struct,
 426                                    result);
 427         if (count != 1) {
 428                 DEBUG(0,("Single %s object not found\n", LDAP_OBJ_IDPOOL));
 429                 goto done;
 430         }
 431
 432         entry = ldap_first_entry(idmap_alloc_ldap->smbldap_state->ldap_struct,
 433                                  result);
 434
 435         dn = smbldap_talloc_dn(ctx,
 436                                idmap_alloc_ldap->smbldap_state->ldap_struct,
 437                                entry);
 438         if ( ! dn) {
 439                 goto done;
 440         }
 441
 442         if ( ! (id_str = smbldap_talloc_single_attribute(idmap_alloc_ldap->smbldap_state->ldap_struct,
 443                                 entry, type, ctx))) {
 444                 DEBUG(0,("%s attribute not found\n", type));
 445                 goto done;
 446         }
 447         if ( ! id_str) {
 448                 DEBUG(0,("Out of memory\n"));
 449                 ret = NT_STATUS_NO_MEMORY;
 450                 goto done;
 451         }
 452
 453         xid->id = strtoul(id_str, NULL, 10);
 454
 455         /* make sure we still have room to grow */
 456
 457         switch (xid->type) {
 458         case ID_TYPE_UID:
 459                 if (xid->id > idmap_alloc_ldap->high_uid) {
 460                         DEBUG(0,("Cannot allocate uid above %lu!\n",
 461                                  (unsigned long)idmap_alloc_ldap->high_uid));
 462                         goto done;
 463                 }
 464                 break;
 465
 466         case ID_TYPE_GID:
 467                 if (xid->id > idmap_alloc_ldap->high_gid) {
 468                         DEBUG(0,("Cannot allocate gid above %lu!\n",
 469                                  (unsigned long)idmap_alloc_ldap->high_uid));
 470                         goto done;
 471                 }
 472                 break;
 473
 474         default:
 475                 /* impossible */
 476                 goto done;
 477         }
 478
 479         new_id_str = talloc_asprintf(ctx, "%lu", (unsigned long)xid->id + 1);
 480         if ( ! new_id_str) {
 481                 DEBUG(0,("Out of memory\n"));
 482                 ret = NT_STATUS_NO_MEMORY;
 483                 goto done;
 484         }
 485
 486         smbldap_set_mod(&mods, LDAP_MOD_DELETE, type, id_str);
 487         smbldap_set_mod(&mods, LDAP_MOD_ADD, type, new_id_str);
 488
 489         if (mods == NULL) {
 490                 DEBUG(0,("smbldap_set_mod() failed.\n"));
 491                 goto done;
 492         }
 493
 494         DEBUG(10, ("Try to atomically increment the id (%s -> %s)\n",
 495                    id_str, new_id_str));
 496
 497         rc = smbldap_modify(idmap_alloc_ldap->smbldap_state, dn, mods);
 498
 499         ldap_mods_free(mods, True);
 500
 501         if (rc != LDAP_SUCCESS) {
 502                 DEBUG(1,("Failed to allocate new %s. "
 503                          "smbldap_modify() failed.\n", type));
 504                 goto done;
 505         }
 506
 507         ret = NT_STATUS_OK;
 508
 509 done:
 510         talloc_free(ctx);
 511         return ret;
 512 }
 513
 514 /**********************************
 515  Get current highest id.
 516 **********************************/
 517
 518 static NTSTATUS idmap_ldap_get_hwm(struct unixid *xid)
 519 {
 520         TALLOC_CTX *memctx;
 521         NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
 522         int rc = LDAP_SERVER_DOWN;
 523         int count = 0;
 524         LDAPMessage *result = NULL;
 525         LDAPMessage *entry = NULL;
 526         char *id_str;
 527         char *filter = NULL;
 528         const char **attr_list;
 529         const char *type;
 530
 531         /* Only do query if we are online */
 532         if (idmap_is_offline()) {
 533                 return NT_STATUS_FILE_IS_OFFLINE;
 534         }
 535
 536         if ( ! idmap_alloc_ldap) {
 537                 return NT_STATUS_UNSUCCESSFUL;
 538         }
 539
 540         memctx = talloc_new(idmap_alloc_ldap);
 541         if ( ! memctx) {
 542                 DEBUG(0, ("Out of memory!\n"));
 543                 return NT_STATUS_NO_MEMORY;
 544         }
 545
 546         /* get type */
 547         switch (xid->type) {
 548
 549         case ID_TYPE_UID:
 550                 type = get_attr_key2string(idpool_attr_list,
 551                                            LDAP_ATTR_UIDNUMBER);
 552                 break;
 553
 554         case ID_TYPE_GID:
 555                 type = get_attr_key2string(idpool_attr_list,
 556                                            LDAP_ATTR_GIDNUMBER);
 557                 break;
 558
 559         default:
 560                 DEBUG(2, ("Invalid ID type (0x%x)\n", xid->type));
 561                 return NT_STATUS_INVALID_PARAMETER;
 562         }
 563
 564         filter = talloc_asprintf(memctx, "(objectClass=%s)", LDAP_OBJ_IDPOOL);
 565         CHECK_ALLOC_DONE(filter);
 566
 567         attr_list = get_attr_list(memctx, idpool_attr_list);
 568         CHECK_ALLOC_DONE(attr_list);
 569
 570         rc = smbldap_search(idmap_alloc_ldap->smbldap_state,
 571                                 idmap_alloc_ldap->suffix,
 572                                LDAP_SCOPE_SUBTREE, filter,
 573                                attr_list, 0, &result);
 574
 575         if (rc != LDAP_SUCCESS) {
 576                 DEBUG(0,("%s object not found\n", LDAP_OBJ_IDPOOL));
 577                 goto done;
 578         }
 579
 580         talloc_autofree_ldapmsg(memctx, result);
 581
 582         count = ldap_count_entries(idmap_alloc_ldap->smbldap_state->ldap_struct,
 583                                    result);
 584         if (count != 1) {
 585                 DEBUG(0,("Single %s object not found\n", LDAP_OBJ_IDPOOL));
 586                 goto done;
 587         }
 588
 589         entry = ldap_first_entry(idmap_alloc_ldap->smbldap_state->ldap_struct,
 590                                  result);
 591
 592         id_str = smbldap_talloc_single_attribute(idmap_alloc_ldap->smbldap_state->ldap_struct,
 593                         entry, type, memctx);
 594         if ( ! id_str) {
 595                 DEBUG(0,("%s attribute not found\n", type));
 596                 goto done;
 597         }
 598         if ( ! id_str) {
 599                 DEBUG(0,("Out of memory\n"));
 600                 ret = NT_STATUS_NO_MEMORY;
 601                 goto done;
 602         }
 603
 604         xid->id = strtoul(id_str, NULL, 10);
 605
 606         ret = NT_STATUS_OK;
 607 done:
 608         talloc_free(memctx);
 609         return ret;
 610 }
 611 /**********************************
 612  Set highest id.
 613 **********************************/
 614
 615 static NTSTATUS idmap_ldap_set_hwm(struct unixid *xid)
 616 {
 617         TALLOC_CTX *ctx;
 618         NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
 619         int rc = LDAP_SERVER_DOWN;
 620         int count = 0;
 621         LDAPMessage *result = NULL;
 622         LDAPMessage *entry = NULL;
 623         LDAPMod **mods = NULL;
 624         char *new_id_str;
 625         char *filter = NULL;
 626         const char *dn = NULL;
 627         const char **attr_list;
 628         const char *type;
 629
 630         /* Only do query if we are online */
 631         if (idmap_is_offline()) {
 632                 return NT_STATUS_FILE_IS_OFFLINE;
 633         }
 634
 635         if ( ! idmap_alloc_ldap) {
 636                 return NT_STATUS_UNSUCCESSFUL;
 637         }
 638
 639         ctx = talloc_new(idmap_alloc_ldap);
 640         if ( ! ctx) {
 641                 DEBUG(0, ("Out of memory!\n"));
 642                 return NT_STATUS_NO_MEMORY;
 643         }
 644
 645         /* get type */
 646         switch (xid->type) {
 647
 648         case ID_TYPE_UID:
 649                 type = get_attr_key2string(idpool_attr_list,
 650                                            LDAP_ATTR_UIDNUMBER);
 651                 break;
 652
 653         case ID_TYPE_GID:
 654                 type = get_attr_key2string(idpool_attr_list,
 655                                            LDAP_ATTR_GIDNUMBER);
 656                 break;
 657
 658         default:
 659                 DEBUG(2, ("Invalid ID type (0x%x)\n", xid->type));
 660                 return NT_STATUS_INVALID_PARAMETER;
 661         }
 662
 663         filter = talloc_asprintf(ctx, "(objectClass=%s)", LDAP_OBJ_IDPOOL);
 664         CHECK_ALLOC_DONE(filter);
 665
 666         attr_list = get_attr_list(ctx, idpool_attr_list);
 667         CHECK_ALLOC_DONE(attr_list);
 668
 669         rc = smbldap_search(idmap_alloc_ldap->smbldap_state,
 670                                 idmap_alloc_ldap->suffix,
 671                                LDAP_SCOPE_SUBTREE, filter,
 672                                attr_list, 0, &result);
 673
 674         if (rc != LDAP_SUCCESS) {
 675                 DEBUG(0,("%s object not found\n", LDAP_OBJ_IDPOOL));
 676                 goto done;
 677         }
 678
 679         talloc_autofree_ldapmsg(ctx, result);
 680
 681         count = ldap_count_entries(idmap_alloc_ldap->smbldap_state->ldap_struct,
 682                                    result);
 683         if (count != 1) {
 684                 DEBUG(0,("Single %s object not found\n", LDAP_OBJ_IDPOOL));
 685                 goto done;
 686         }
 687
 688         entry = ldap_first_entry(idmap_alloc_ldap->smbldap_state->ldap_struct,
 689                                  result);
 690
 691         dn = smbldap_talloc_dn(ctx,
 692                                 idmap_alloc_ldap->smbldap_state->ldap_struct,
 693                                 entry);
 694         if ( ! dn) {
 695                 goto done;
 696         }
 697
 698         new_id_str = talloc_asprintf(ctx, "%lu", (unsigned long)xid->id);
 699         if ( ! new_id_str) {
 700                 DEBUG(0,("Out of memory\n"));
 701                 ret = NT_STATUS_NO_MEMORY;
 702                 goto done;
 703         }
 704
 705         smbldap_set_mod(&mods, LDAP_MOD_REPLACE, type, new_id_str);
 706
 707         if (mods == NULL) {
 708                 DEBUG(0,("smbldap_set_mod() failed.\n"));
 709                 goto done;
 710         }
 711
 712         rc = smbldap_modify(idmap_alloc_ldap->smbldap_state, dn, mods);
 713
 714         ldap_mods_free(mods, True);
 715
 716         if (rc != LDAP_SUCCESS) {
 717                 DEBUG(1,("Failed to allocate new %s. "
 718                          "smbldap_modify() failed.\n", type));
 719                 goto done;
 720         }
 721
 722         ret = NT_STATUS_OK;
 723
 724 done:
 725         talloc_free(ctx);
 726         return ret;
 727 }
 728
 729 /**********************************
 730  Close idmap ldap alloc
 731 **********************************/
 732
 733 static NTSTATUS idmap_ldap_alloc_close(void)
 734 {
 735         if (idmap_alloc_ldap) {
 736                 smbldap_free_struct(&idmap_alloc_ldap->smbldap_state);
 737                 DEBUG(5,("The connection to the LDAP server was closed\n"));
 738                 /* maybe free the results here --metze */
 739                 TALLOC_FREE(idmap_alloc_ldap);
 740         }
 741         return NT_STATUS_OK;
 742 }
 743
 744
 745 /**********************************************************************
 746  IDMAP MAPPING LDAP BACKEND
 747 **********************************************************************/
 748
 749 static int idmap_ldap_close_destructor(struct idmap_ldap_context *ctx)
 750 {
 751         smbldap_free_struct(&ctx->smbldap_state);
 752         DEBUG(5,("The connection to the LDAP server was closed\n"));
 753         /* maybe free the results here --metze */
 754
 755         return 0;
 756 }
 757
 758 /********************************
 759  Initialise idmap database.
 760 ********************************/
 761
 762 static NTSTATUS idmap_ldap_db_init(struct idmap_domain *dom,
 763                                    const char *params)
 764 {
 765         NTSTATUS ret;
 766         struct idmap_ldap_context *ctx = NULL;
 767         char *config_option = NULL;
 768         const char *tmp = NULL;
 769
 770         /* Only do init if we are online */
 771         if (idmap_is_offline()) {
 772                 return NT_STATUS_FILE_IS_OFFLINE;
 773         }
 774
 775         ctx = TALLOC_ZERO_P(dom, struct idmap_ldap_context);
 776         if ( ! ctx) {
 777                 DEBUG(0, ("Out of memory!\n"));
 778                 return NT_STATUS_NO_MEMORY;
 779         }
 780
 781         if (strequal(dom->name, "*")) {
 782                 uid_t low_uid = 0;
 783                 uid_t high_uid = 0;
 784                 gid_t low_gid = 0;
 785                 gid_t high_gid = 0;
 786
 787                 ctx->filter_low_id = 0;
 788                 ctx->filter_high_id = 0;
 789
 790                 if (lp_idmap_uid(&low_uid, &high_uid)) {
 791                         ctx->filter_low_id = low_uid;
 792                         ctx->filter_high_id = high_uid;
 793                 } else {
 794                         DEBUG(3, ("Warning: 'idmap uid' not set!\n"));
 795                 }
 796
 797                 if (lp_idmap_gid(&low_gid, &high_gid)) {
 798                         if ((low_gid != low_uid) || (high_gid != high_uid)) {
 799                                 DEBUG(1, ("Warning: 'idmap uid' and 'idmap gid'"
 800                                       " ranges do not agree -- building "
 801                                       "intersection\n"));
 802                                 ctx->filter_low_id = MAX(ctx->filter_low_id,
 803                                                          low_gid);
 804                                 ctx->filter_high_id = MIN(ctx->filter_high_id,
 805                                                           high_gid);
 806                         }
 807                 } else {
 808                         DEBUG(3, ("Warning: 'idmap gid' not set!\n"));
 809                 }
 810         } else {
 811                 const char *range = NULL;
 812
 813                 config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
 814                 if ( ! config_option) {
 815                         DEBUG(0, ("Out of memory!\n"));
 816                         ret = NT_STATUS_NO_MEMORY;
 817                         goto done;
 818                 }
 819
 820                 /* load ranges */
 821                 range = lp_parm_const_string(-1, config_option, "range", NULL);
 822                 if (range && range[0]) {
 823                         if ((sscanf(range, "%u - %u", &ctx->filter_low_id,
 824                                                         &ctx->filter_high_id) != 2))
 825                         {
 826                                 DEBUG(1, ("ERROR: invalid filter range [%s]", range));
 827                                 ctx->filter_low_id = 0;
 828                                 ctx->filter_high_id = 0;
 829                         }
 830                 }
 831         }
 832
 833         if (ctx->filter_low_id > ctx->filter_high_id) {
 834                 DEBUG(1, ("ERROR: invalid filter range [%u-%u]",
 835                       ctx->filter_low_id, ctx->filter_high_id));
 836                 ctx->filter_low_id = 0;
 837                 ctx->filter_high_id = 0;
 838         }
 839
 840         if (params != NULL) {
 841                 /* assume location is the only parameter */
 842                 ctx->url = talloc_strdup(ctx, params);
 843         } else {
 844                 tmp = lp_parm_const_string(-1, config_option, "ldap_url", NULL);
 845
 846                 if ( ! tmp) {
 847                         DEBUG(1, ("ERROR: missing idmap ldap url\n"));
 848                         ret = NT_STATUS_UNSUCCESSFUL;
 849                         goto done;
 850                 }
 851
 852                 ctx->url = talloc_strdup(ctx, tmp);
 853         }
 854         CHECK_ALLOC_DONE(ctx->url);
 855
 856         trim_char(ctx->url, '\"', '\"');
 857
 858         tmp = lp_parm_const_string(-1, config_option, "ldap_base_dn", NULL);
 859         if ( ! tmp || ! *tmp) {
 860                 tmp = lp_ldap_idmap_suffix();
 861                 if ( ! tmp) {
 862                         DEBUG(1, ("ERROR: missing idmap ldap suffix\n"));
 863                         ret = NT_STATUS_UNSUCCESSFUL;
 864                         goto done;
 865                 }
 866         }
 867
 868         ctx->suffix = talloc_strdup(ctx, tmp);
 869         CHECK_ALLOC_DONE(ctx->suffix);
 870
 871         ret = smbldap_init(ctx, winbind_event_context(), ctx->url,
 872                            &ctx->smbldap_state);
 873         if (!NT_STATUS_IS_OK(ret)) {
 874                 DEBUG(1, ("ERROR: smbldap_init (%s) failed!\n", ctx->url));
 875                 goto done;
 876         }
 877
 878         ret = get_credentials( ctx, ctx->smbldap_state, config_option,
 879                                dom, &ctx->user_dn );
 880         if ( !NT_STATUS_IS_OK(ret) ) {
 881                 DEBUG(1,("idmap_ldap_db_init: Failed to get connection "
 882                          "credentials (%s)\n", nt_errstr(ret)));
 883                 goto done;
 884         }
 885
 886         /* set the destructor on the context, so that resource are properly
 887            freed if the contexts is released */
 888
 889         talloc_set_destructor(ctx, idmap_ldap_close_destructor);
 890
 891         dom->private_data = ctx;
 892
 893         talloc_free(config_option);
 894         return NT_STATUS_OK;
 895
 896 /*failed */
 897 done:
 898         talloc_free(ctx);
 899         return ret;
 900 }
 901
 902 /* max number of ids requested per batch query */
 903 #define IDMAP_LDAP_MAX_IDS 30
 904
 905 /**********************************
 906  lookup a set of unix ids.
 907 **********************************/
 908
 909 /* this function searches up to IDMAP_LDAP_MAX_IDS entries
 910  * in maps for a match */
 911 static struct id_map *find_map_by_id(struct id_map **maps,
 912                                      enum id_type type,
 913                                      uint32_t id)
 914 {
 915         int i;
 916
 917         for (i = 0; i < IDMAP_LDAP_MAX_IDS; i++) {
 918                 if (maps[i] == NULL) { /* end of the run */
 919                         return NULL;
 920                 }
 921                 if ((maps[i]->xid.type == type) && (maps[i]->xid.id == id)) {
 922                         return maps[i];
 923                 }
 924         }
 925
 926         return NULL;
 927 }
 928
 929 static NTSTATUS idmap_ldap_unixids_to_sids(struct idmap_domain *dom,
 930                                            struct id_map **ids)
 931 {
 932         NTSTATUS ret;
 933         TALLOC_CTX *memctx;
 934         struct idmap_ldap_context *ctx;
 935         LDAPMessage *result = NULL;
 936         const char *uidNumber;
 937         const char *gidNumber;
 938         const char **attr_list;
 939         char *filter = NULL;
 940         bool multi = False;
 941         int idx = 0;
 942         int bidx = 0;
 943         int count;
 944         int rc;
 945         int i;
 946
 947         /* Only do query if we are online */
 948         if (idmap_is_offline()) {
 949                 return NT_STATUS_FILE_IS_OFFLINE;
 950         }
 951
 952         ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
 953
 954         memctx = talloc_new(ctx);
 955         if ( ! memctx) {
 956                 DEBUG(0, ("Out of memory!\n"));
 957                 return NT_STATUS_NO_MEMORY;
 958         }
 959
 960         uidNumber = get_attr_key2string(idpool_attr_list, LDAP_ATTR_UIDNUMBER);
 961         gidNumber = get_attr_key2string(idpool_attr_list, LDAP_ATTR_GIDNUMBER);
 962
 963         attr_list = get_attr_list(memctx, sidmap_attr_list);
 964
 965         if ( ! ids[1]) {
 966                 /* if we are requested just one mapping use the simple filter */
 967
 968                 filter = talloc_asprintf(memctx, "(&(objectClass=%s)(%s=%lu))",
 969                                 LDAP_OBJ_IDMAP_ENTRY,
 970                                 (ids[0]->xid.type==ID_TYPE_UID)?uidNumber:gidNumber,
 971                                 (unsigned long)ids[0]->xid.id);
 972                 CHECK_ALLOC_DONE(filter);
 973                 DEBUG(10, ("Filter: [%s]\n", filter));
 974         } else {
 975                 /* multiple mappings */
 976                 multi = True;
 977         }
 978
 979         for (i = 0; ids[i]; i++) {
 980                 ids[i]->status = ID_UNKNOWN;
 981         }
 982
 983 again:
 984         if (multi) {
 985
 986                 talloc_free(filter);
 987                 filter = talloc_asprintf(memctx,
 988                                          "(&(objectClass=%s)(|",
 989                                          LDAP_OBJ_IDMAP_ENTRY);
 990                 CHECK_ALLOC_DONE(filter);
 991
 992                 bidx = idx;
 993                 for (i = 0; (i < IDMAP_LDAP_MAX_IDS) && ids[idx]; i++, idx++) {
 994                         filter = talloc_asprintf_append_buffer(filter, "(%s=%lu)",
 995                                         (ids[idx]->xid.type==ID_TYPE_UID)?uidNumber:gidNumber,
 996                                         (unsigned long)ids[idx]->xid.id);
 997                         CHECK_ALLOC_DONE(filter);
 998                 }
 999                 filter = talloc_asprintf_append_buffer(filter, "))");
1000                 CHECK_ALLOC_DONE(filter);
1001                 DEBUG(10, ("Filter: [%s]\n", filter));
1002         } else {
1003                 bidx = 0;
1004                 idx = 1;
1005         }
1006
1007         rc = smbldap_search(ctx->smbldap_state, ctx->suffix, LDAP_SCOPE_SUBTREE,
1008                 filter, attr_list, 0, &result);
1009
1010         if (rc != LDAP_SUCCESS) {
1011                 DEBUG(3,("Failure looking up ids (%s)\n", ldap_err2string(rc)));
1012                 ret = NT_STATUS_UNSUCCESSFUL;
1013                 goto done;
1014         }
1015
1016         count = ldap_count_entries(ctx->smbldap_state->ldap_struct, result);
1017
1018         if (count == 0) {
1019                 DEBUG(10, ("NO SIDs found\n"));
1020         }
1021
1022         for (i = 0; i < count; i++) {
1023                 LDAPMessage *entry = NULL;
1024                 char *sidstr = NULL;
1025                 char *tmp = NULL;
1026                 enum id_type type;
1027                 struct id_map *map;
1028                 uint32_t id;
1029
1030                 if (i == 0) { /* first entry */
1031                         entry = ldap_first_entry(ctx->smbldap_state->ldap_struct,
1032                                                  result);
1033                 } else { /* following ones */
1034                         entry = ldap_next_entry(ctx->smbldap_state->ldap_struct,
1035                                                 entry);
1036                 }
1037                 if ( ! entry) {
1038                         DEBUG(2, ("ERROR: Unable to fetch ldap entries "
1039                                   "from results\n"));
1040                         break;
1041                 }
1042
1043                 /* first check if the SID is present */
1044                 sidstr = smbldap_talloc_single_attribute(
1045                                 ctx->smbldap_state->ldap_struct,
1046                                 entry, LDAP_ATTRIBUTE_SID, memctx);
1047                 if ( ! sidstr) { /* no sid, skip entry */
1048                         DEBUG(2, ("WARNING SID not found on entry\n"));
1049                         continue;
1050                 }
1051
1052                 /* now try to see if it is a uid, if not try with a gid
1053                  * (gid is more common, but in case both uidNumber and
1054                  * gidNumber are returned the SID is mapped to the uid
1055                  *not the gid) */
1056                 type = ID_TYPE_UID;
1057                 tmp = smbldap_talloc_single_attribute(
1058                                 ctx->smbldap_state->ldap_struct,
1059                                 entry, uidNumber, memctx);
1060                 if ( ! tmp) {
1061                         type = ID_TYPE_GID;
1062                         tmp = smbldap_talloc_single_attribute(
1063                                         ctx->smbldap_state->ldap_struct,
1064                                         entry, gidNumber, memctx);
1065                 }
1066                 if ( ! tmp) { /* wow very strange entry, how did it match ? */
1067                         DEBUG(5, ("Unprobable match on (%s), no uidNumber, "
1068                                   "nor gidNumber returned\n", sidstr));
1069                         TALLOC_FREE(sidstr);
1070                         continue;
1071                 }
1072
1073                 id = strtoul(tmp, NULL, 10);
1074                 if ((id == 0) ||
1075                     (ctx->filter_low_id && (id < ctx->filter_low_id)) ||
1076                     (ctx->filter_high_id && (id > ctx->filter_high_id))) {
1077                         DEBUG(5, ("Requested id (%u) out of range (%u - %u). "
1078                                   "Filtered!\n", id,
1079                                   ctx->filter_low_id, ctx->filter_high_id));
1080                         TALLOC_FREE(sidstr);
1081                         TALLOC_FREE(tmp);
1082                         continue;
1083                 }
1084                 TALLOC_FREE(tmp);
1085
1086                 map = find_map_by_id(&ids[bidx], type, id);
1087                 if (!map) {
1088                         DEBUG(2, ("WARNING: couldn't match sid (%s) "
1089                                   "with requested ids\n", sidstr));
1090                         TALLOC_FREE(sidstr);
1091                         continue;
1092                 }
1093
1094                 if ( ! string_to_sid(map->sid, sidstr)) {
1095                         DEBUG(2, ("ERROR: Invalid SID on entry\n"));
1096                         TALLOC_FREE(sidstr);
1097                         continue;
1098                 }
1099                 TALLOC_FREE(sidstr);
1100
1101                 /* mapped */
1102                 map->status = ID_MAPPED;
1103
1104                 DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
1105                            (unsigned long)map->xid.id, map->xid.type));
1106         }
1107
1108         /* free the ldap results */
1109         if (result) {
1110                 ldap_msgfree(result);
1111                 result = NULL;
1112         }
1113
1114         if (multi && ids[idx]) { /* still some values to map */
1115                 goto again;
1116         }
1117
1118         ret = NT_STATUS_OK;
1119
1120         /* mark all unknwon/expired ones as unmapped */
1121         for (i = 0; ids[i]; i++) {
1122                 if (ids[i]->status != ID_MAPPED)
1123                         ids[i]->status = ID_UNMAPPED;
1124         }
1125
1126 done:
1127         talloc_free(memctx);
1128         return ret;
1129 }
1130
1131 /**********************************
1132  lookup a set of sids.
1133 **********************************/
1134
1135 /* this function searches up to IDMAP_LDAP_MAX_IDS entries
1136  * in maps for a match */
1137 static struct id_map *find_map_by_sid(struct id_map **maps, DOM_SID *sid)
1138 {
1139         int i;
1140
1141         for (i = 0; i < IDMAP_LDAP_MAX_IDS; i++) {
1142                 if (maps[i] == NULL) { /* end of the run */
1143                         return NULL;
1144                 }
1145                 if (sid_equal(maps[i]->sid, sid)) {
1146                         return maps[i];
1147                 }
1148         }
1149
1150         return NULL;
1151 }
1152
1153 static NTSTATUS idmap_ldap_sids_to_unixids(struct idmap_domain *dom,
1154                                            struct id_map **ids)
1155 {
1156         LDAPMessage *entry = NULL;
1157         NTSTATUS ret;
1158         TALLOC_CTX *memctx;
1159         struct idmap_ldap_context *ctx;
1160         LDAPMessage *result = NULL;
1161         const char *uidNumber;
1162         const char *gidNumber;
1163         const char **attr_list;
1164         char *filter = NULL;
1165         bool multi = False;
1166         int idx = 0;
1167         int bidx = 0;
1168         int count;
1169         int rc;
1170         int i;
1171
1172         /* Only do query if we are online */
1173         if (idmap_is_offline()) {
1174                 return NT_STATUS_FILE_IS_OFFLINE;
1175         }
1176
1177         ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
1178
1179         memctx = talloc_new(ctx);
1180         if ( ! memctx) {
1181                 DEBUG(0, ("Out of memory!\n"));
1182                 return NT_STATUS_NO_MEMORY;
1183         }
1184
1185         uidNumber = get_attr_key2string(idpool_attr_list, LDAP_ATTR_UIDNUMBER);
1186         gidNumber = get_attr_key2string(idpool_attr_list, LDAP_ATTR_GIDNUMBER);
1187
1188         attr_list = get_attr_list(memctx, sidmap_attr_list);
1189
1190         if ( ! ids[1]) {
1191                 /* if we are requested just one mapping use the simple filter */
1192
1193                 filter = talloc_asprintf(memctx, "(&(objectClass=%s)(%s=%s))",
1194                                 LDAP_OBJ_IDMAP_ENTRY,
1195                                 LDAP_ATTRIBUTE_SID,
1196                                 sid_string_talloc(memctx, ids[0]->sid));
1197                 CHECK_ALLOC_DONE(filter);
1198                 DEBUG(10, ("Filter: [%s]\n", filter));
1199         } else {
1200                 /* multiple mappings */
1201                 multi = True;
1202         }
1203
1204         for (i = 0; ids[i]; i++) {
1205                 ids[i]->status = ID_UNKNOWN;
1206         }
1207
1208 again:
1209         if (multi) {
1210
1211                 TALLOC_FREE(filter);
1212                 filter = talloc_asprintf(memctx,
1213                                          "(&(objectClass=%s)(|",
1214                                          LDAP_OBJ_IDMAP_ENTRY);
1215                 CHECK_ALLOC_DONE(filter);
1216
1217                 bidx = idx;
1218                 for (i = 0; (i < IDMAP_LDAP_MAX_IDS) && ids[idx]; i++, idx++) {
1219                         filter = talloc_asprintf_append_buffer(filter, "(%s=%s)",
1220                                         LDAP_ATTRIBUTE_SID,
1221                                         sid_string_talloc(memctx,
1222                                                           ids[idx]->sid));
1223                         CHECK_ALLOC_DONE(filter);
1224                 }
1225                 filter = talloc_asprintf_append_buffer(filter, "))");
1226                 CHECK_ALLOC_DONE(filter);
1227                 DEBUG(10, ("Filter: [%s]", filter));
1228         } else {
1229                 bidx = 0;
1230                 idx = 1;
1231         }
1232
1233         rc = smbldap_search(ctx->smbldap_state, ctx->suffix, LDAP_SCOPE_SUBTREE,
1234                 filter, attr_list, 0, &result);
1235
1236         if (rc != LDAP_SUCCESS) {
1237                 DEBUG(3,("Failure looking up sids (%s)\n",
1238                          ldap_err2string(rc)));
1239                 ret = NT_STATUS_UNSUCCESSFUL;
1240                 goto done;
1241         }
1242
1243         count = ldap_count_entries(ctx->smbldap_state->ldap_struct, result);
1244
1245         if (count == 0) {
1246                 DEBUG(10, ("NO SIDs found\n"));
1247         }
1248
1249         for (i = 0; i < count; i++) {
1250                 char *sidstr = NULL;
1251                 char *tmp = NULL;
1252                 enum id_type type;
1253                 struct id_map *map;
1254                 DOM_SID sid;
1255                 uint32_t id;
1256
1257                 if (i == 0) { /* first entry */
1258                         entry = ldap_first_entry(ctx->smbldap_state->ldap_struct,
1259                                                  result);
1260                 } else { /* following ones */
1261                         entry = ldap_next_entry(ctx->smbldap_state->ldap_struct,
1262                                                 entry);
1263                 }
1264                 if ( ! entry) {
1265                         DEBUG(2, ("ERROR: Unable to fetch ldap entries "
1266                                   "from results\n"));
1267                         break;
1268                 }
1269
1270                 /* first check if the SID is present */
1271                 sidstr = smbldap_talloc_single_attribute(
1272                                 ctx->smbldap_state->ldap_struct,
1273                                 entry, LDAP_ATTRIBUTE_SID, memctx);
1274                 if ( ! sidstr) { /* no sid ??, skip entry */
1275                         DEBUG(2, ("WARNING SID not found on entry\n"));
1276                         continue;
1277                 }
1278
1279                 if ( ! string_to_sid(&sid, sidstr)) {
1280                         DEBUG(2, ("ERROR: Invalid SID on entry\n"));
1281                         TALLOC_FREE(sidstr);
1282                         continue;
1283                 }
1284
1285                 map = find_map_by_sid(&ids[bidx], &sid);
1286                 if (!map) {
1287                         DEBUG(2, ("WARNING: couldn't find entry sid (%s) "
1288                                   "in ids", sidstr));
1289                         TALLOC_FREE(sidstr);
1290                         continue;
1291                 }
1292
1293                 TALLOC_FREE(sidstr);
1294
1295                 /* now try to see if it is a uid, if not try with a gid
1296                  * (gid is more common, but in case both uidNumber and
1297                  * gidNumber are returned the SID is mapped to the uid
1298                  * not the gid) */
1299                 type = ID_TYPE_UID;
1300                 tmp = smbldap_talloc_single_attribute(
1301                                 ctx->smbldap_state->ldap_struct,
1302                                 entry, uidNumber, memctx);
1303                 if ( ! tmp) {
1304                         type = ID_TYPE_GID;
1305                         tmp = smbldap_talloc_single_attribute(
1306                                         ctx->smbldap_state->ldap_struct,
1307                                         entry, gidNumber, memctx);
1308                 }
1309                 if ( ! tmp) { /* no ids ?? */
1310                         DEBUG(5, ("no uidNumber, "
1311                                   "nor gidNumber attributes found\n"));
1312                         continue;
1313                 }
1314
1315                 id = strtoul(tmp, NULL, 10);
1316                 if ((id == 0) ||
1317                     (ctx->filter_low_id && (id < ctx->filter_low_id)) ||
1318                     (ctx->filter_high_id && (id > ctx->filter_high_id))) {
1319                         DEBUG(5, ("Requested id (%u) out of range (%u - %u). "
1320                                   "Filtered!\n", id,
1321                                   ctx->filter_low_id, ctx->filter_high_id));
1322                         TALLOC_FREE(tmp);
1323                         continue;
1324                 }
1325                 TALLOC_FREE(tmp);
1326
1327                 /* mapped */
1328                 map->xid.type = type;
1329                 map->xid.id = id;
1330                 map->status = ID_MAPPED;
1331
1332                 DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
1333                            (unsigned long)map->xid.id, map->xid.type));
1334         }
1335
1336         /* free the ldap results */
1337         if (result) {
1338                 ldap_msgfree(result);
1339                 result = NULL;
1340         }
1341
1342         if (multi && ids[idx]) { /* still some values to map */
1343                 goto again;
1344         }
1345
1346         ret = NT_STATUS_OK;
1347
1348         /* mark all unknwon/expired ones as unmapped */
1349         for (i = 0; ids[i]; i++) {
1350                 if (ids[i]->status != ID_MAPPED)
1351                         ids[i]->status = ID_UNMAPPED;
1352         }
1353
1354 done:
1355         talloc_free(memctx);
1356         return ret;
1357 }
1358
1359 /**********************************
1360  set a mapping.
1361 **********************************/
1362
1363 /* TODO: change this:  This function cannot be called to modify a mapping,
1364  * only set a new one */
1365
1366 static NTSTATUS idmap_ldap_set_mapping(struct idmap_domain *dom,
1367                                        const struct id_map *map)
1368 {
1369         NTSTATUS ret;
1370         TALLOC_CTX *memctx;
1371         struct idmap_ldap_context *ctx;
1372         LDAPMessage *entry = NULL;
1373         LDAPMod **mods = NULL;
1374         const char *type;
1375         char *id_str;
1376         char *sid;
1377         char *dn;
1378         int rc = -1;
1379
1380         /* Only do query if we are online */
1381         if (idmap_is_offline()) {
1382                 return NT_STATUS_FILE_IS_OFFLINE;
1383         }
1384
1385         ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
1386
1387         switch(map->xid.type) {
1388         case ID_TYPE_UID:
1389                 type = get_attr_key2string(sidmap_attr_list,
1390                                            LDAP_ATTR_UIDNUMBER);
1391                 break;
1392
1393         case ID_TYPE_GID:
1394                 type = get_attr_key2string(sidmap_attr_list,
1395                                            LDAP_ATTR_GIDNUMBER);
1396                 break;
1397
1398         default:
1399                 return NT_STATUS_INVALID_PARAMETER;
1400         }
1401
1402         memctx = talloc_new(ctx);
1403         if ( ! memctx) {
1404                 DEBUG(0, ("Out of memory!\n"));
1405                 return NT_STATUS_NO_MEMORY;
1406         }
1407
1408         id_str = talloc_asprintf(memctx, "%lu", (unsigned long)map->xid.id);
1409         CHECK_ALLOC_DONE(id_str);
1410
1411         sid = talloc_strdup(memctx, sid_string_talloc(memctx, map->sid));
1412         CHECK_ALLOC_DONE(sid);
1413
1414         dn = talloc_asprintf(memctx, "%s=%s,%s",
1415                         get_attr_key2string(sidmap_attr_list, LDAP_ATTR_SID),
1416                         sid,
1417                         ctx->suffix);
1418         CHECK_ALLOC_DONE(dn);
1419
1420         smbldap_set_mod(&mods, LDAP_MOD_ADD,
1421                         "objectClass", LDAP_OBJ_IDMAP_ENTRY);
1422
1423         smbldap_make_mod(ctx->smbldap_state->ldap_struct,
1424                          entry, &mods, type, id_str);
1425
1426         smbldap_make_mod(ctx->smbldap_state->ldap_struct, entry, &mods,
1427                          get_attr_key2string(sidmap_attr_list, LDAP_ATTR_SID),
1428                          sid);
1429
1430         if ( ! mods) {
1431                 DEBUG(2, ("ERROR: No mods?\n"));
1432                 ret = NT_STATUS_UNSUCCESSFUL;
1433                 goto done;
1434         }
1435
1436         /* TODO: remove conflicting mappings! */
1437
1438         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_SID_ENTRY);
1439
1440         DEBUG(10, ("Set DN %s (%s -> %s)\n", dn, sid, id_str));
1441
1442         rc = smbldap_add(ctx->smbldap_state, dn, mods);
1443         ldap_mods_free(mods, True);
1444
1445         if (rc != LDAP_SUCCESS) {
1446                 char *ld_error = NULL;
1447                 ldap_get_option(ctx->smbldap_state->ldap_struct,
1448                                 LDAP_OPT_ERROR_STRING, &ld_error);
1449                 DEBUG(0,("ldap_set_mapping_internals: Failed to add %s to %lu "
1450                          "mapping [%s]\n", sid,
1451                          (unsigned long)map->xid.id, type));
1452                 DEBUG(0, ("ldap_set_mapping_internals: Error was: %s (%s)\n",
1453                         ld_error ? ld_error : "(NULL)", ldap_err2string (rc)));
1454                 if (ld_error) {
1455                         ldap_memfree(ld_error);
1456                 }
1457                 ret = NT_STATUS_UNSUCCESSFUL;
1458                 goto done;
1459         }
1460
1461         DEBUG(10,("ldap_set_mapping: Successfully created mapping from %s to "
1462                   "%lu [%s]\n", sid, (unsigned long)map->xid.id, type));
1463
1464         ret = NT_STATUS_OK;
1465
1466 done:
1467         talloc_free(memctx);
1468         return ret;
1469 }
1470
1471 /**********************************
1472  Close the idmap ldap instance
1473 **********************************/
1474
1475 static NTSTATUS idmap_ldap_close(struct idmap_domain *dom)
1476 {
1477         struct idmap_ldap_context *ctx;
1478
1479         if (dom->private_data) {
1480                 ctx = talloc_get_type(dom->private_data,
1481                                       struct idmap_ldap_context);
1482
1483                 talloc_free(ctx);
1484                 dom->private_data = NULL;
1485         }
1486
1487         return NT_STATUS_OK;
1488 }
1489
1490 static struct idmap_methods idmap_ldap_methods = {
1491
1492         .init = idmap_ldap_db_init,
1493         .unixids_to_sids = idmap_ldap_unixids_to_sids,
1494         .sids_to_unixids = idmap_ldap_sids_to_unixids,
1495         .set_mapping = idmap_ldap_set_mapping,
1496         .close_fn = idmap_ldap_close
1497 };
1498
1499 static struct idmap_alloc_methods idmap_ldap_alloc_methods = {
1500
1501         .init = idmap_ldap_alloc_init,
1502         .allocate_id = idmap_ldap_allocate_id,
1503         .get_id_hwm = idmap_ldap_get_hwm,
1504         .set_id_hwm = idmap_ldap_set_hwm,
1505         .close_fn = idmap_ldap_alloc_close,
1506         /* .dump_data = TODO */
1507 };
1508
1509 static NTSTATUS idmap_alloc_ldap_init(void)
1510 {
1511         return smb_register_idmap_alloc(SMB_IDMAP_INTERFACE_VERSION, "ldap",
1512                                         &idmap_ldap_alloc_methods);
1513 }
1514
1515 NTSTATUS idmap_ldap_init(void);
1516 NTSTATUS idmap_ldap_init(void)
1517 {
1518         NTSTATUS ret;
1519
1520         /* FIXME: bad hack to actually register also the alloc_ldap module
1521          * without changining configure.in */
1522         ret = idmap_alloc_ldap_init();
1523         if (! NT_STATUS_IS_OK(ret)) {
1524                 return ret;
1525         }
1526         return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "ldap",
1527                                   &idmap_ldap_methods);
1528 }
1529