2 Unix SMB/CIFS implementation.
4 Copyright (C) Tim Potter 2000
5 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
6 Copyright (C) Simo Sorce 2003-2007
7 Copyright (C) Jeremy Allison 2006
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 #define DBGC_CLASS DBGC_IDMAP
31 struct idmap_backend
{
33 struct idmap_methods
*methods
;
34 struct idmap_backend
*prev
, *next
;
37 struct idmap_alloc_backend
{
39 struct idmap_alloc_methods
*methods
;
40 struct idmap_alloc_backend
*prev
, *next
;
43 struct idmap_cache_ctx
;
45 struct idmap_alloc_context
{
47 struct idmap_alloc_methods
*methods
;
51 static TALLOC_CTX
*idmap_ctx
= NULL
;
52 static struct idmap_cache_ctx
*idmap_cache
;
54 static struct idmap_backend
*backends
= NULL
;
55 static struct idmap_domain
**idmap_domains
= NULL
;
56 static int num_domains
= 0;
57 static int pdb_dom_num
= -1;
58 static int def_dom_num
= -1;
60 static struct idmap_alloc_backend
*alloc_backends
= NULL
;
61 static struct idmap_alloc_context
*idmap_alloc_ctx
= NULL
;
63 #define IDMAP_CHECK_RET(ret) do { \
64 if ( ! NT_STATUS_IS_OK(ret)) { \
65 DEBUG(2, ("ERROR: NTSTATUS = 0x%08x\n", NT_STATUS_V(ret))); \
68 #define IDMAP_REPORT_RET(ret) do { \
69 if ( ! NT_STATUS_IS_OK(ret)) { \
70 DEBUG(2, ("ERROR: NTSTATUS = 0x%08x\n", NT_STATUS_V(ret))); \
72 #define IDMAP_CHECK_ALLOC(mem) do { \
74 DEBUG(0, ("Out of memory!\n")); ret = NT_STATUS_NO_MEMORY; \
78 static struct idmap_methods
*get_methods(const char *name
)
80 struct idmap_backend
*b
;
82 for (b
= backends
; b
; b
= b
->next
) {
83 if (strequal(b
->name
, name
)) {
91 static struct idmap_alloc_methods
*get_alloc_methods(const char *name
)
93 struct idmap_alloc_backend
*b
;
95 for (b
= alloc_backends
; b
; b
= b
->next
) {
96 if (strequal(b
->name
, name
)) {
104 bool idmap_is_offline(void)
106 return ( lp_winbind_offline_logon() &&
107 get_global_winbindd_state_offline() );
110 /**********************************************************************
111 Allow a module to register itself as a method.
112 **********************************************************************/
114 NTSTATUS
smb_register_idmap(int version
, const char *name
,
115 struct idmap_methods
*methods
)
117 struct idmap_methods
*test
;
118 struct idmap_backend
*entry
;
121 return NT_STATUS_INTERNAL_DB_ERROR
;
124 if ((version
!= SMB_IDMAP_INTERFACE_VERSION
)) {
125 DEBUG(0, ("Failed to register idmap module.\n"
126 "The module was compiled against "
127 "SMB_IDMAP_INTERFACE_VERSION %d,\n"
128 "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
129 "Please recompile against the current version "
131 version
, SMB_IDMAP_INTERFACE_VERSION
));
132 return NT_STATUS_OBJECT_TYPE_MISMATCH
;
135 if (!name
|| !name
[0] || !methods
) {
136 DEBUG(0,("Called with NULL pointer or empty name!\n"));
137 return NT_STATUS_INVALID_PARAMETER
;
140 test
= get_methods(name
);
142 DEBUG(0,("Idmap module %s already registered!\n", name
));
143 return NT_STATUS_OBJECT_NAME_COLLISION
;
146 entry
= talloc(idmap_ctx
, struct idmap_backend
);
148 DEBUG(0,("Out of memory!\n"));
149 return NT_STATUS_NO_MEMORY
;
151 entry
->name
= talloc_strdup(idmap_ctx
, name
);
152 if ( ! entry
->name
) {
153 DEBUG(0,("Out of memory!\n"));
154 return NT_STATUS_NO_MEMORY
;
156 entry
->methods
= methods
;
158 DLIST_ADD(backends
, entry
);
159 DEBUG(5, ("Successfully added idmap backend '%s'\n", name
));
163 /**********************************************************************
164 Allow a module to register itself as a method.
165 **********************************************************************/
167 NTSTATUS
smb_register_idmap_alloc(int version
, const char *name
,
168 struct idmap_alloc_methods
*methods
)
170 struct idmap_alloc_methods
*test
;
171 struct idmap_alloc_backend
*entry
;
174 return NT_STATUS_INTERNAL_DB_ERROR
;
177 if ((version
!= SMB_IDMAP_INTERFACE_VERSION
)) {
178 DEBUG(0, ("Failed to register idmap alloc module.\n"
179 "The module was compiled against "
180 "SMB_IDMAP_INTERFACE_VERSION %d,\n"
181 "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
182 "Please recompile against the current version "
184 version
, SMB_IDMAP_INTERFACE_VERSION
));
185 return NT_STATUS_OBJECT_TYPE_MISMATCH
;
188 if (!name
|| !name
[0] || !methods
) {
189 DEBUG(0,("Called with NULL pointer or empty name!\n"));
190 return NT_STATUS_INVALID_PARAMETER
;
193 test
= get_alloc_methods(name
);
195 DEBUG(0,("idmap_alloc module %s already registered!\n", name
));
196 return NT_STATUS_OBJECT_NAME_COLLISION
;
199 entry
= talloc(idmap_ctx
, struct idmap_alloc_backend
);
201 DEBUG(0,("Out of memory!\n"));
202 return NT_STATUS_NO_MEMORY
;
204 entry
->name
= talloc_strdup(idmap_ctx
, name
);
205 if ( ! entry
->name
) {
206 DEBUG(0,("Out of memory!\n"));
207 return NT_STATUS_NO_MEMORY
;
209 entry
->methods
= methods
;
211 DLIST_ADD(alloc_backends
, entry
);
212 DEBUG(5, ("Successfully added idmap alloc backend '%s'\n", name
));
216 static int close_domain_destructor(struct idmap_domain
*dom
)
220 ret
= dom
->methods
->close_fn(dom
);
221 if (!NT_STATUS_IS_OK(ret
)) {
222 DEBUG(3, ("Failed to close idmap domain [%s]!\n", dom
->name
));
228 /**************************************************************************
230 **************************************************************************/
232 NTSTATUS
idmap_close(void)
234 /* close the alloc backend first before freeing idmap_ctx */
235 if (idmap_alloc_ctx
) {
236 idmap_alloc_ctx
->methods
->close_fn();
237 idmap_alloc_ctx
->methods
= NULL
;
239 alloc_backends
= NULL
;
241 /* this talloc_free call will fire the talloc destructors
242 * that will free all active backends resources */
243 TALLOC_FREE(idmap_ctx
);
245 idmap_domains
= NULL
;
251 /****************************************************************************
252 ****************************************************************************/
254 NTSTATUS
idmap_init_cache(void)
256 /* Always initialize the cache. We'll have to delay initialization
257 of backends if we are offline */
263 if ( (idmap_ctx
= talloc_named_const(NULL
, 0, "idmap_ctx")) == NULL
) {
264 return NT_STATUS_NO_MEMORY
;
267 if ( (idmap_cache
= idmap_cache_init(idmap_ctx
)) == NULL
) {
268 return NT_STATUS_UNSUCCESSFUL
;
274 /****************************************************************************
275 ****************************************************************************/
277 NTSTATUS
idmap_init(void)
280 static NTSTATUS idmap_init_status
= NT_STATUS_UNSUCCESSFUL
;
281 struct idmap_domain
*dom
;
282 char *compat_backend
= NULL
;
283 char *compat_params
= NULL
;
284 const char **dom_list
= NULL
;
285 const char *default_domain
= NULL
;
286 char *alloc_backend
= NULL
;
287 bool default_already_defined
= False
;
288 bool pri_dom_is_in_list
= False
;
292 ret
= idmap_init_cache();
293 if (!NT_STATUS_IS_OK(ret
))
296 if (NT_STATUS_IS_OK(idmap_init_status
)) {
300 /* We can't reliably call intialization code here unless
301 we are online. But return NT_STATUS_OK so the upper
302 level code doesn't abort idmap lookups. */
304 if ( get_global_winbindd_state_offline() ) {
305 idmap_init_status
= NT_STATUS_FILE_IS_OFFLINE
;
311 dom_list
= lp_idmap_domains();
313 if ( lp_idmap_backend() ) {
314 const char **compat_list
= lp_idmap_backend();
316 const char *q
= NULL
;
319 DEBUG(0, ("WARNING: idmap backend and idmap domains are"
320 " mutually exclusive!\n"));
321 DEBUGADD(0,("idmap backend option will be IGNORED!\n"));
325 compat_backend
= talloc_strdup(idmap_ctx
, *compat_list
);
327 /* strip any leading idmap_ prefix of */
328 if (strncmp(*compat_list
, "idmap_", 6) == 0 ) {
329 q
= *compat_list
+= 6;
330 DEBUG(0, ("WARNING: idmap backend uses obsolete"
331 " and deprecated 'idmap_' prefix.\n"
332 "Please replace 'idmap_%s' by '%s' in"
333 " %s\n", q
, q
, get_dyn_CONFIGFILE()));
334 compat_backend
= talloc_strdup(idmap_ctx
, q
);
336 compat_backend
= talloc_strdup(idmap_ctx
,
340 if (compat_backend
== NULL
) {
341 ret
= NT_STATUS_NO_MEMORY
;
345 /* separate the backend and module arguements */
346 if ((p
= strchr(compat_backend
, ':')) != NULL
) {
348 compat_params
= p
+ 1;
351 } else if ( !dom_list
) {
352 /* Back compatible: without idmap domains and explicit
353 idmap backend. Taking default idmap backend: tdb */
356 compat_backend
= talloc_strdup( idmap_ctx
, "tdb");
357 compat_params
= compat_backend
;
361 /* generate a list with our main domain */
364 dl
= talloc_array(idmap_ctx
, const char *, 2);
366 ret
= NT_STATUS_NO_MEMORY
;
369 dl
[0] = talloc_strdup(dl
, lp_workgroup());
371 ret
= NT_STATUS_NO_MEMORY
;
379 default_domain
= dl
[0];
382 /***************************
383 * initialize idmap domains
385 DEBUG(1, ("Initializing idmap domains\n"));
387 for (i
=0, num_domains
=0; dom_list
[i
]; i
++) {
388 const char *parm_backend
;
391 /* ignore BUILTIN and local MACHINE domains */
392 if (strequal(dom_list
[i
], "BUILTIN")
393 || strequal(dom_list
[i
], get_global_sam_name()))
395 DEBUG(0,("idmap_init: Ignoring domain %s\n",
400 if ((dom_list
[i
] != default_domain
) &&
401 strequal(dom_list
[i
], lp_workgroup())) {
402 pri_dom_is_in_list
= True
;
406 dom
= TALLOC_ZERO_P(idmap_ctx
, struct idmap_domain
);
407 IDMAP_CHECK_ALLOC(dom
);
409 dom
->name
= talloc_strdup(dom
, dom_list
[i
]);
410 IDMAP_CHECK_ALLOC(dom
->name
);
412 config_option
= talloc_asprintf(dom
, "idmap config %s",
414 IDMAP_CHECK_ALLOC(config_option
);
416 /* default or specific ? */
418 dom
->default_domain
= lp_parm_bool(-1, config_option
,
421 if (dom
->default_domain
||
422 (default_domain
&& strequal(dom_list
[i
], default_domain
))) {
424 /* make sure this is set even when we match
426 dom
->default_domain
= True
;
428 if (default_already_defined
) {
429 DEBUG(1, ("ERROR: Multiple domains defined as"
431 ret
= NT_STATUS_INVALID_PARAMETER
;
435 default_already_defined
= True
;
439 dom
->readonly
= lp_parm_bool(-1, config_option
,
442 /* find associated backend (default: tdb) */
444 parm_backend
= talloc_strdup(idmap_ctx
, compat_backend
);
446 parm_backend
= talloc_strdup(idmap_ctx
,
447 lp_parm_const_string(
451 IDMAP_CHECK_ALLOC(parm_backend
);
453 /* get the backend methods for this domain */
454 dom
->methods
= get_methods(parm_backend
);
456 if ( ! dom
->methods
) {
457 ret
= smb_probe_module("idmap", parm_backend
);
458 if (NT_STATUS_IS_OK(ret
)) {
459 dom
->methods
= get_methods(parm_backend
);
462 if ( ! dom
->methods
) {
463 DEBUG(0, ("ERROR: Could not get methods for "
464 "backend %s\n", parm_backend
));
465 ret
= NT_STATUS_UNSUCCESSFUL
;
469 /* check the set_mapping function exists otherwise mark the
470 * module as readonly */
471 if ( ! dom
->methods
->set_mapping
) {
472 DEBUG(5, ("Forcing to readonly, as this module can't"
473 " store arbitrary mappings.\n"));
474 dom
->readonly
= True
;
477 /* now that we have methods,
478 * set the destructor for this domain */
479 talloc_set_destructor(dom
, close_domain_destructor
);
482 dom
->params
= talloc_strdup(dom
, compat_params
);
483 IDMAP_CHECK_ALLOC(dom
->params
);
488 /* Finally instance a backend copy for this domain */
489 ret
= dom
->methods
->init(dom
);
490 if ( ! NT_STATUS_IS_OK(ret
)) {
491 DEBUG(0, ("ERROR: Initialization failed for backend "
492 "%s (domain %s), deferred!\n",
493 parm_backend
, dom
->name
));
495 idmap_domains
= talloc_realloc(idmap_ctx
, idmap_domains
,
496 struct idmap_domain
*, i
+1);
497 if ( ! idmap_domains
) {
498 DEBUG(0, ("Out of memory!\n"));
499 ret
= NT_STATUS_NO_MEMORY
;
502 idmap_domains
[num_domains
] = dom
;
504 /* save default domain position for future uses */
505 if (dom
->default_domain
) {
506 def_dom_num
= num_domains
;
509 /* Bump counter to next available slot */
513 DEBUG(10, ("Domain %s - Backend %s - %sdefault - %sreadonly\n",
514 dom
->name
, parm_backend
,
515 dom
->default_domain
?"":"not ",
516 dom
->readonly
?"":"not "));
518 talloc_free(config_option
);
521 /* on DCs we need to add idmap_tdb as the default backend if compat is
522 * defined (when the old implicit configuration is used)
523 * This is not done in the previous loop a on member server we exclude
524 * the local domain. But on a DC the local domain is the only domain
525 * available therefore we are left with no default domain */
526 if (((lp_server_role() == ROLE_DOMAIN_PDC
) ||
527 (lp_server_role() == ROLE_DOMAIN_BDC
)) &&
528 ((num_domains
== 0) && (compat
== 1))) {
530 dom
= TALLOC_ZERO_P(idmap_ctx
, struct idmap_domain
);
531 IDMAP_CHECK_ALLOC(dom
);
533 dom
->name
= talloc_strdup(dom
, "__default__");
534 IDMAP_CHECK_ALLOC(dom
->name
);
536 dom
->default_domain
= True
;
537 dom
->readonly
= False
;
539 /* get the backend methods for this domain */
540 dom
->methods
= get_methods(compat_backend
);
541 if ( ! dom
->methods
) {
542 ret
= smb_probe_module("idmap", compat_backend
);
543 if (NT_STATUS_IS_OK(ret
)) {
544 dom
->methods
= get_methods(compat_backend
);
547 if ( ! dom
->methods
) {
548 DEBUG(0, ("ERROR: Could not get methods for "
549 "backend %s\n", compat_backend
));
550 ret
= NT_STATUS_UNSUCCESSFUL
;
554 /* now that we have methods,
555 * set the destructor for this domain */
556 talloc_set_destructor(dom
, close_domain_destructor
);
559 dom
->params
= talloc_strdup(dom
, compat_params
);
560 IDMAP_CHECK_ALLOC(dom
->params
);
565 /* Finally instance a backend copy for this domain */
566 ret
= dom
->methods
->init(dom
);
567 if ( ! NT_STATUS_IS_OK(ret
)) {
568 DEBUG(0, ("ERROR: Initialization failed for backend "
569 "%s (domain %s), deferred!\n",
570 compat_backend
, dom
->name
));
572 idmap_domains
= talloc_realloc(idmap_ctx
, idmap_domains
,
573 struct idmap_domain
*, 2);
574 if ( ! idmap_domains
) {
575 DEBUG(0, ("Out of memory!\n"));
576 ret
= NT_STATUS_NO_MEMORY
;
579 idmap_domains
[num_domains
] = dom
;
581 def_dom_num
= num_domains
;
583 /* Bump counter to next available slot */
587 DEBUG(10, ("Domain %s - Backend %s - %sdefault - %sreadonly\n",
588 dom
->name
, compat_backend
,
589 dom
->default_domain
?"":"not ",
590 dom
->readonly
?"":"not "));
593 /* automatically add idmap_nss backend if needed */
594 if ((lp_server_role() == ROLE_DOMAIN_MEMBER
) &&
595 ( ! pri_dom_is_in_list
) &&
596 lp_winbind_trusted_domains_only()) {
598 dom
= TALLOC_ZERO_P(idmap_ctx
, struct idmap_domain
);
599 IDMAP_CHECK_ALLOC(dom
);
601 dom
->name
= talloc_strdup(dom
, lp_workgroup());
602 IDMAP_CHECK_ALLOC(dom
->name
);
604 dom
->default_domain
= False
;
605 dom
->readonly
= True
;
607 /* get the backend methods for nss */
608 dom
->methods
= get_methods("nss");
610 /* (the nss module is always statically linked) */
611 if ( ! dom
->methods
) {
612 DEBUG(0, ("ERROR: No methods for idmap_nss ?!\n"));
613 ret
= NT_STATUS_UNSUCCESSFUL
;
617 /* now that we have methods,
618 * set the destructor for this domain */
619 talloc_set_destructor(dom
, close_domain_destructor
);
622 dom
->params
= talloc_strdup(dom
, compat_params
);
623 IDMAP_CHECK_ALLOC(dom
->params
);
628 /* Finally instance a backend copy for this domain */
629 ret
= dom
->methods
->init(dom
);
630 if ( ! NT_STATUS_IS_OK(ret
)) {
631 DEBUG(0, ("ERROR: Init. failed for idmap_nss ?!\n"));
632 ret
= NT_STATUS_UNSUCCESSFUL
;
636 idmap_domains
= talloc_realloc(idmap_ctx
,
638 struct idmap_domain
*,
640 if ( ! idmap_domains
) {
641 DEBUG(0, ("Out of memory!\n"));
642 ret
= NT_STATUS_NO_MEMORY
;
645 idmap_domains
[num_domains
] = dom
;
647 DEBUG(10, ("Domain %s - Backend nss - not default - readonly\n",
653 /**** automatically add idmap_passdb backend ****/
654 dom
= TALLOC_ZERO_P(idmap_ctx
, struct idmap_domain
);
655 IDMAP_CHECK_ALLOC(dom
);
657 dom
->name
= talloc_strdup(dom
, get_global_sam_name());
658 IDMAP_CHECK_ALLOC(dom
->name
);
660 dom
->default_domain
= False
;
661 dom
->readonly
= True
;
663 /* get the backend methods for passdb */
664 dom
->methods
= get_methods("passdb");
666 /* (the passdb module is always statically linked) */
667 if ( ! dom
->methods
) {
668 DEBUG(0, ("ERROR: No methods for idmap_passdb ?!\n"));
669 ret
= NT_STATUS_UNSUCCESSFUL
;
673 /* now that we have methods, set the destructor for this domain */
674 talloc_set_destructor(dom
, close_domain_destructor
);
677 dom
->params
= talloc_strdup(dom
, compat_params
);
678 IDMAP_CHECK_ALLOC(dom
->params
);
683 /* Finally instance a backend copy for this domain */
684 ret
= dom
->methods
->init(dom
);
685 if ( ! NT_STATUS_IS_OK(ret
)) {
686 DEBUG(0, ("ERROR: Init. failed for idmap_passdb ?!\n"));
687 ret
= NT_STATUS_UNSUCCESSFUL
;
691 idmap_domains
= talloc_realloc(idmap_ctx
,
693 struct idmap_domain
*,
695 if ( ! idmap_domains
) {
696 DEBUG(0, ("Out of memory!\n"));
697 ret
= NT_STATUS_NO_MEMORY
;
700 idmap_domains
[num_domains
] = dom
;
702 /* needed to handle special BUILTIN and wellknown SIDs cases */
703 pdb_dom_num
= num_domains
;
705 DEBUG(10, ("Domain %s - Backend passdb - not default - readonly\n",
709 /**** finished adding idmap_passdb backend ****/
711 /* sort domains so that the default is the last one */
712 /* don't sort if no default domain defined */
713 if (def_dom_num
!= -1 && def_dom_num
!= num_domains
-1) {
714 /* default is not last, move it */
715 struct idmap_domain
*tmp
;
717 if (pdb_dom_num
> def_dom_num
) {
720 } else if (pdb_dom_num
== def_dom_num
) { /* ?? */
721 pdb_dom_num
= num_domains
- 1;
724 tmp
= idmap_domains
[def_dom_num
];
726 for (i
= def_dom_num
; i
< num_domains
-1; i
++) {
727 idmap_domains
[i
] = idmap_domains
[i
+1];
729 idmap_domains
[i
] = tmp
;
734 /* Initialize alloc module */
736 DEBUG(3, ("Initializing idmap alloc module\n"));
738 alloc_backend
= NULL
;
740 alloc_backend
= talloc_strdup(idmap_ctx
, compat_backend
);
742 char *ab
= lp_idmap_alloc_backend();
744 if (ab
&& (ab
[0] != '\0')) {
745 alloc_backend
= talloc_strdup(idmap_ctx
,
746 lp_idmap_alloc_backend());
750 if ( alloc_backend
) {
752 idmap_alloc_ctx
= TALLOC_ZERO_P(idmap_ctx
,
753 struct idmap_alloc_context
);
754 IDMAP_CHECK_ALLOC(idmap_alloc_ctx
);
756 idmap_alloc_ctx
->methods
= get_alloc_methods(alloc_backend
);
757 if ( ! idmap_alloc_ctx
->methods
) {
758 ret
= smb_probe_module("idmap", alloc_backend
);
759 if (NT_STATUS_IS_OK(ret
)) {
760 idmap_alloc_ctx
->methods
=
761 get_alloc_methods(alloc_backend
);
764 if (idmap_alloc_ctx
->methods
) {
767 idmap_alloc_ctx
->params
=
768 talloc_strdup(idmap_alloc_ctx
,
770 IDMAP_CHECK_ALLOC(idmap_alloc_ctx
->params
);
772 idmap_alloc_ctx
->params
= NULL
;
775 ret
= idmap_alloc_ctx
->methods
->init(idmap_alloc_ctx
->params
);
776 if ( ! NT_STATUS_IS_OK(ret
)) {
777 DEBUG(0, ("ERROR: Initialization failed for "
778 "alloc backend %s, deferred!\n",
781 idmap_alloc_ctx
->initialized
= True
;
784 DEBUG(2, ("idmap_init: Unable to get methods for "
785 "alloc backend %s\n",
787 /* certain compat backends are just readonly */
789 TALLOC_FREE(idmap_alloc_ctx
);
792 ret
= NT_STATUS_UNSUCCESSFUL
;
797 /* cleanup temporary strings */
798 TALLOC_FREE( compat_backend
);
800 idmap_init_status
= NT_STATUS_OK
;
805 DEBUG(0, ("Aborting IDMAP Initialization ...\n"));
811 static NTSTATUS
idmap_alloc_init(void)
815 if (! NT_STATUS_IS_OK(ret
= idmap_init())) {
819 if ( ! idmap_alloc_ctx
) {
820 return NT_STATUS_NOT_SUPPORTED
;
823 if ( ! idmap_alloc_ctx
->initialized
) {
824 ret
= idmap_alloc_ctx
->methods
->init(idmap_alloc_ctx
->params
);
825 if ( ! NT_STATUS_IS_OK(ret
)) {
826 DEBUG(0, ("ERROR: Initialization failed for alloc "
827 "backend, deferred!\n"));
830 idmap_alloc_ctx
->initialized
= True
;
837 /**************************************************************************
838 idmap allocator interface functions
839 **************************************************************************/
841 NTSTATUS
idmap_allocate_uid(struct unixid
*id
)
845 if (! NT_STATUS_IS_OK(ret
= idmap_alloc_init())) {
849 id
->type
= ID_TYPE_UID
;
850 return idmap_alloc_ctx
->methods
->allocate_id(id
);
853 NTSTATUS
idmap_allocate_gid(struct unixid
*id
)
857 if (! NT_STATUS_IS_OK(ret
= idmap_alloc_init())) {
861 id
->type
= ID_TYPE_GID
;
862 return idmap_alloc_ctx
->methods
->allocate_id(id
);
865 NTSTATUS
idmap_set_uid_hwm(struct unixid
*id
)
869 if (! NT_STATUS_IS_OK(ret
= idmap_alloc_init())) {
873 id
->type
= ID_TYPE_UID
;
874 return idmap_alloc_ctx
->methods
->set_id_hwm(id
);
877 NTSTATUS
idmap_set_gid_hwm(struct unixid
*id
)
881 if (! NT_STATUS_IS_OK(ret
= idmap_alloc_init())) {
885 id
->type
= ID_TYPE_GID
;
886 return idmap_alloc_ctx
->methods
->set_id_hwm(id
);
889 /******************************************************************************
890 Lookup an idmap_domain give a full user or group SID
891 ******************************************************************************/
893 static struct idmap_domain
* find_idmap_domain_from_sid( DOM_SID
*account_sid
)
897 struct winbindd_domain
*domain
= NULL
;
900 /* 1. Handle BUILTIN or Special SIDs and prevent them from
901 falling into the default domain space (if we have a
902 configured passdb backend. */
904 if ( (pdb_dom_num
!= -1) &&
905 (sid_check_is_in_builtin(account_sid
) ||
906 sid_check_is_in_wellknown_domain(account_sid
) ||
907 sid_check_is_in_unix_groups(account_sid
) ||
908 sid_check_is_in_unix_users(account_sid
)) )
910 return idmap_domains
[pdb_dom_num
];
913 /* 2. Lookup the winbindd_domain from the account_sid */
915 sid_copy( &domain_sid
, account_sid
);
916 sid_split_rid( &domain_sid
, &rid
);
917 domain
= find_domain_from_sid_noinit( &domain_sid
);
919 for (i
= 0; domain
&& i
< num_domains
; i
++) {
920 if ( strequal( idmap_domains
[i
]->name
, domain
->name
) ) {
921 return idmap_domains
[i
];
925 /* 3. Fall back to the default domain */
927 if ( def_dom_num
!= -1 ) {
928 return idmap_domains
[def_dom_num
];
934 /******************************************************************************
935 Lookup an index given an idmap_domain pointer
936 ******************************************************************************/
938 static uint32_t find_idmap_domain_index( struct idmap_domain
*id_domain
)
942 for (i
= 0; i
< num_domains
; i
++) {
943 if ( idmap_domains
[i
] == id_domain
)
951 /*********************************************************
952 Check if creating a mapping is permitted for the domain
953 *********************************************************/
955 static NTSTATUS
idmap_can_map(const struct id_map
*map
,
956 struct idmap_domain
**ret_dom
)
958 struct idmap_domain
*dom
;
960 /* Check we do not create mappings for our own local domain,
961 * or BUILTIN or special SIDs */
962 if ((sid_compare_domain(map
->sid
, get_global_sam_sid()) == 0) ||
963 sid_check_is_in_builtin(map
->sid
) ||
964 sid_check_is_in_wellknown_domain(map
->sid
) ||
965 sid_check_is_in_unix_users(map
->sid
) ||
966 sid_check_is_in_unix_groups(map
->sid
) )
968 DEBUG(10, ("We are not supposed to create mappings for our own "
969 "domains (local, builtin, specials)\n"));
970 return NT_STATUS_UNSUCCESSFUL
;
973 /* Special check for trusted domain only = Yes */
974 if (lp_winbind_trusted_domains_only()) {
975 struct winbindd_domain
*wdom
= find_our_domain();
976 if (wdom
&& (sid_compare_domain(map
->sid
, &wdom
->sid
) == 0)) {
977 DEBUG(10, ("We are not supposed to create mappings for "
978 "our primary domain when <trusted domain "
980 DEBUGADD(10, ("Leave [%s] unmapped\n",
981 sid_string_dbg(map
->sid
)));
982 return NT_STATUS_UNSUCCESSFUL
;
986 if ( (dom
= find_idmap_domain_from_sid( map
->sid
)) == NULL
) {
987 /* huh, couldn't find a suitable domain,
988 * let's just leave it unmapped */
989 DEBUG(10, ("Could not find idmap backend for SID %s\n",
990 sid_string_dbg(map
->sid
)));
991 return NT_STATUS_NO_SUCH_DOMAIN
;
995 /* ouch the domain is read only,
996 * let's just leave it unmapped */
997 DEBUG(10, ("idmap backend for SID %s is READONLY!\n",
998 sid_string_dbg(map
->sid
)));
999 return NT_STATUS_UNSUCCESSFUL
;
1003 return NT_STATUS_OK
;
1006 static NTSTATUS
idmap_new_mapping(TALLOC_CTX
*ctx
, struct id_map
*map
)
1009 struct idmap_domain
*dom
;
1011 /* If we are offline we cannot lookup SIDs, deny mapping */
1012 if (idmap_is_offline()) {
1013 return NT_STATUS_FILE_IS_OFFLINE
;
1016 ret
= idmap_can_map(map
, &dom
);
1017 if ( ! NT_STATUS_IS_OK(ret
)) {
1018 return NT_STATUS_NONE_MAPPED
;
1021 /* check if this is a valid SID and then map it */
1022 switch (map
->xid
.type
) {
1024 ret
= idmap_allocate_uid(&map
->xid
);
1025 if ( ! NT_STATUS_IS_OK(ret
)) {
1026 /* can't allocate id, let's just leave it unmapped */
1027 DEBUG(2, ("uid allocation failed! "
1028 "Can't create mapping\n"));
1029 return NT_STATUS_NONE_MAPPED
;
1033 ret
= idmap_allocate_gid(&map
->xid
);
1034 if ( ! NT_STATUS_IS_OK(ret
)) {
1035 /* can't allocate id, let's just leave it unmapped */
1036 DEBUG(2, ("gid allocation failed! "
1037 "Can't create mapping\n"));
1038 return NT_STATUS_NONE_MAPPED
;
1042 /* invalid sid, let's just leave it unmapped */
1043 DEBUG(3,("idmap_new_mapping: Refusing to create a "
1044 "mapping for an unspecified ID type.\n"));
1045 return NT_STATUS_NONE_MAPPED
;
1048 /* ok, got a new id, let's set a mapping */
1049 map
->status
= ID_MAPPED
;
1051 DEBUG(10, ("Setting mapping: %s <-> %s %lu\n",
1052 sid_string_dbg(map
->sid
),
1053 (map
->xid
.type
== ID_TYPE_UID
) ? "UID" : "GID",
1054 (unsigned long)map
->xid
.id
));
1055 ret
= dom
->methods
->set_mapping(dom
, map
);
1057 if ( ! NT_STATUS_IS_OK(ret
)) {
1058 /* something wrong here :-( */
1059 DEBUG(2, ("Failed to commit mapping\n!"));
1061 /* TODO: would it make sense to have an "unalloc_id function?" */
1063 return NT_STATUS_NONE_MAPPED
;
1066 return NT_STATUS_OK
;
1069 static NTSTATUS
idmap_backends_set_mapping(const struct id_map
*map
)
1071 struct idmap_domain
*dom
;
1074 DEBUG(10, ("Setting mapping %s <-> %s %lu\n",
1075 sid_string_dbg(map
->sid
),
1076 (map
->xid
.type
== ID_TYPE_UID
) ? "UID" : "GID",
1077 (unsigned long)map
->xid
.id
));
1079 ret
= idmap_can_map(map
, &dom
);
1080 if ( ! NT_STATUS_IS_OK(ret
)) {
1084 DEBUG(10,("set_mapping for domain %s\n", dom
->name
));
1086 return dom
->methods
->set_mapping(dom
, map
);
1089 static NTSTATUS
idmap_backends_unixids_to_sids(struct id_map
**ids
)
1091 struct idmap_domain
*dom
;
1092 struct id_map
**unmapped
;
1093 struct id_map
**_ids
;
1098 if (!ids
|| !*ids
) {
1099 DEBUG(1, ("Invalid list of maps\n"));
1100 return NT_STATUS_INVALID_PARAMETER
;
1103 ctx
= talloc_named_const(NULL
, 0, "idmap_backends_unixids_to_sids ctx");
1105 DEBUG(0, ("Out of memory!\n"));
1106 return NT_STATUS_NO_MEMORY
;
1109 DEBUG(10, ("Query backends to map ids->sids\n"));
1111 /* start from the default (the last one) and then if there are still
1112 * unmapped entries cycle through the others */
1117 for (n
= num_domains
-1; n
>= 0; n
--) { /* cycle backwards */
1119 dom
= idmap_domains
[n
];
1121 DEBUG(10, ("Query sids from domain %s\n", dom
->name
));
1123 ret
= dom
->methods
->unixids_to_sids(dom
, _ids
);
1124 IDMAP_REPORT_RET(ret
);
1128 for (i
= 0, u
= 0; _ids
[i
]; i
++) {
1129 if (_ids
[i
]->status
!= ID_MAPPED
) {
1130 unmapped
= talloc_realloc(ctx
, unmapped
,
1131 struct id_map
*, u
+ 2);
1132 IDMAP_CHECK_ALLOC(unmapped
);
1133 unmapped
[u
] = _ids
[i
];
1138 /* terminate the unmapped list */
1140 } else { /* no more entries, get out */
1149 /* there are still unmapped ids,
1150 * map them to the unix users/groups domains */
1151 /* except for expired entries,
1152 * these will be returned as valid (offline mode) */
1153 for (i
= 0; unmapped
[i
]; i
++) {
1154 if (unmapped
[i
]->status
== ID_EXPIRED
) continue;
1155 switch (unmapped
[i
]->xid
.type
) {
1157 uid_to_unix_users_sid(
1158 (uid_t
)unmapped
[i
]->xid
.id
,
1160 unmapped
[i
]->status
= ID_MAPPED
;
1163 gid_to_unix_groups_sid(
1164 (gid_t
)unmapped
[i
]->xid
.id
,
1166 unmapped
[i
]->status
= ID_MAPPED
;
1168 default: /* what?! */
1169 unmapped
[i
]->status
= ID_UNKNOWN
;
1182 static NTSTATUS
idmap_backends_sids_to_unixids(struct id_map
**ids
)
1184 struct id_map
***dom_ids
;
1185 struct idmap_domain
*dom
;
1190 if ( (ctx
= talloc_named_const(NULL
, 0, "be_sids_to_ids")) == NULL
) {
1191 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1192 return NT_STATUS_NO_MEMORY
;
1195 DEBUG(10, ("Query backends to map sids->ids\n"));
1197 /* split list per domain */
1198 if (num_domains
== 0) {
1199 DEBUG(1, ("No domains available?\n"));
1200 return NT_STATUS_UNSUCCESSFUL
;
1203 dom_ids
= TALLOC_ZERO_ARRAY(ctx
, struct id_map
**, num_domains
);
1204 IDMAP_CHECK_ALLOC(dom_ids
);
1205 counters
= TALLOC_ZERO_ARRAY(ctx
, int, num_domains
);
1206 IDMAP_CHECK_ALLOC(counters
);
1208 /* partition the requests by domain */
1210 for (i
= 0; ids
[i
]; i
++) {
1213 if ((dom
= find_idmap_domain_from_sid(ids
[i
]->sid
)) == NULL
) {
1214 /* no available idmap_domain. Move on */
1218 DEBUG(10,("SID %s is being handled by %s\n",
1219 sid_string_dbg(ids
[i
]->sid
),
1220 dom
? dom
->name
: "none" ));
1222 idx
= find_idmap_domain_index( dom
);
1223 SMB_ASSERT( idx
!= -1 );
1225 dom_ids
[idx
] = talloc_realloc(ctx
, dom_ids
[idx
],
1228 IDMAP_CHECK_ALLOC(dom_ids
[idx
]);
1230 dom_ids
[idx
][counters
[idx
]] = ids
[i
];
1232 dom_ids
[idx
][counters
[idx
]] = NULL
;
1235 /* All the ids have been dispatched in the right queues.
1236 Let's cycle through the filled ones */
1238 for (i
= 0; i
< num_domains
; i
++) {
1240 dom
= idmap_domains
[i
];
1241 DEBUG(10, ("Query ids from domain %s\n", dom
->name
));
1242 ret
= dom
->methods
->sids_to_unixids(dom
, dom_ids
[i
]);
1243 IDMAP_REPORT_RET(ret
);
1247 /* ok all the backends have been contacted at this point */
1248 /* let's see if we have any unmapped SID left and act accordingly */
1250 for (i
= 0; ids
[i
]; i
++) {
1251 /* NOTE: this will NOT touch ID_EXPIRED entries that the backend
1252 * was not able to confirm/deny (offline mode) */
1253 if (ids
[i
]->status
== ID_UNKNOWN
||
1254 ids
[i
]->status
== ID_UNMAPPED
) {
1255 /* ok this is an unmapped one, see if we can map it */
1256 ret
= idmap_new_mapping(ctx
, ids
[i
]);
1257 if (NT_STATUS_IS_OK(ret
)) {
1258 /* successfully mapped */
1259 ids
[i
]->status
= ID_MAPPED
;
1261 if (NT_STATUS_EQUAL(ret
, NT_STATUS_NONE_MAPPED
)) {
1262 /* could not map it */
1263 ids
[i
]->status
= ID_UNMAPPED
;
1265 /* Something very bad happened down there
1266 * OR we are offline */
1267 ids
[i
]->status
= ID_UNKNOWN
;
1279 /**************************************************************************
1280 idmap interface functions
1281 **************************************************************************/
1283 NTSTATUS
idmap_unixids_to_sids(struct id_map
**ids
)
1287 struct id_map
**bids
;
1290 struct winbindd_domain
*our_domain
= find_our_domain();
1292 if (! NT_STATUS_IS_OK(ret
= idmap_init())) {
1296 if (!ids
|| !*ids
) {
1297 DEBUG(1, ("Invalid list of maps\n"));
1298 return NT_STATUS_INVALID_PARAMETER
;
1301 ctx
= talloc_named_const(NULL
, 0, "idmap_unixids_to_sids ctx");
1303 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1304 return NT_STATUS_NO_MEMORY
;
1307 /* no ids to be asked to the backends by default */
1311 for (i
= 0; ids
[i
]; i
++) {
1313 if ( ! ids
[i
]->sid
) {
1314 DEBUG(1, ("invalid null SID in id_map array"));
1316 return NT_STATUS_INVALID_PARAMETER
;
1319 ret
= idmap_cache_map_id(idmap_cache
, ids
[i
]);
1321 if ( ! NT_STATUS_IS_OK(ret
)) {
1324 /* alloc space for ids to be resolved by
1325 * backends (realloc ten by ten) */
1326 bids
= TALLOC_ARRAY(ctx
, struct id_map
*, 10);
1328 DEBUG(1, ("Out of memory!\n"));
1330 return NT_STATUS_NO_MEMORY
;
1335 /* add this id to the ones to be retrieved
1336 * from the backends */
1340 /* check if we need to allocate new space
1341 * on the rids array */
1344 bids
= talloc_realloc(ctx
, bids
,
1345 struct id_map
*, bn
);
1347 DEBUG(1, ("Out of memory!\n"));
1349 return NT_STATUS_NO_MEMORY
;
1353 /* make sure the last element is NULL */
1358 /* let's see if there is any id mapping to be retieved
1359 * from the backends */
1363 /* Only do query if we are online */
1364 online
= !IS_DOMAIN_OFFLINE(our_domain
);
1366 ret
= idmap_backends_unixids_to_sids(bids
);
1367 IDMAP_CHECK_RET(ret
);
1370 /* update the cache */
1371 for (i
= 0; i
< bi
; i
++) {
1372 if (bids
[i
]->status
== ID_MAPPED
) {
1373 ret
= idmap_cache_set(idmap_cache
, bids
[i
]);
1374 } else if (bids
[i
]->status
== ID_EXPIRED
) {
1375 /* the cache returned an expired entry and the
1376 * backend was not able to clear the situation
1377 * (offline). This handles a previous
1378 * NT_STATUS_SYNCHRONIZATION_REQUIRED
1379 * for disconnected mode, */
1380 bids
[i
]->status
= ID_MAPPED
;
1381 } else if (bids
[i
]->status
== ID_UNKNOWN
) {
1382 /* something bad here. We were not able to
1383 * handle this for some reason, mark it as
1384 * unmapped and hope next time things will
1386 bids
[i
]->status
= ID_UNMAPPED
;
1387 } else if (online
) { /* unmapped */
1388 ret
= idmap_cache_set_negative_id(idmap_cache
,
1391 IDMAP_CHECK_RET(ret
);
1401 NTSTATUS
idmap_sids_to_unixids(struct id_map
**ids
)
1405 struct id_map
**bids
;
1408 struct winbindd_domain
*our_domain
= find_our_domain();
1410 if (! NT_STATUS_IS_OK(ret
= idmap_init())) {
1414 if (!ids
|| !*ids
) {
1415 DEBUG(1, ("Invalid list of maps\n"));
1416 return NT_STATUS_INVALID_PARAMETER
;
1419 ctx
= talloc_named_const(NULL
, 0, "idmap_sids_to_unixids ctx");
1421 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1422 return NT_STATUS_NO_MEMORY
;
1425 /* no ids to be asked to the backends by default */
1429 for (i
= 0; ids
[i
]; i
++) {
1431 if ( ! ids
[i
]->sid
) {
1432 DEBUG(1, ("invalid null SID in id_map array\n"));
1434 return NT_STATUS_INVALID_PARAMETER
;
1437 ret
= idmap_cache_map_sid(idmap_cache
, ids
[i
]);
1439 if ( ! NT_STATUS_IS_OK(ret
)) {
1442 /* alloc space for ids to be resolved
1443 by backends (realloc ten by ten) */
1444 bids
= TALLOC_ARRAY(ctx
, struct id_map
*, 10);
1446 DEBUG(1, ("Out of memory!\n"));
1448 return NT_STATUS_NO_MEMORY
;
1453 /* add this id to the ones to be retrieved
1454 * from the backends */
1458 /* check if we need to allocate new space
1459 * on the ids array */
1462 bids
= talloc_realloc(ctx
, bids
,
1463 struct id_map
*, bn
);
1465 DEBUG(1, ("Out of memory!\n"));
1467 return NT_STATUS_NO_MEMORY
;
1471 /* make sure the last element is NULL */
1476 /* let's see if there is any id mapping to be retieved
1477 * from the backends */
1481 /* Only do query if we are online */
1482 online
= !IS_DOMAIN_OFFLINE(our_domain
);
1484 ret
= idmap_backends_sids_to_unixids(bids
);
1485 IDMAP_CHECK_RET(ret
);
1488 /* update the cache */
1489 for (i
= 0; bids
[i
]; i
++) {
1490 if (bids
[i
]->status
== ID_MAPPED
) {
1491 ret
= idmap_cache_set(idmap_cache
, bids
[i
]);
1492 } else if (bids
[i
]->status
== ID_EXPIRED
) {
1493 /* the cache returned an expired entry and the
1494 * backend was not able to clear the situation
1495 * (offline). This handles a previous
1496 * NT_STATUS_SYNCHRONIZATION_REQUIRED
1497 * for disconnected mode, */
1498 bids
[i
]->status
= ID_MAPPED
;
1499 } else if (bids
[i
]->status
== ID_UNKNOWN
) {
1500 /* something bad here. We were not able to
1501 * handle this for some reason, mark it as
1502 * unmapped and hope next time things will
1504 bids
[i
]->status
= ID_UNMAPPED
;
1505 } else if (online
) { /* unmapped */
1506 ret
= idmap_cache_set_negative_sid(idmap_cache
,
1509 IDMAP_CHECK_RET(ret
);
1519 NTSTATUS
idmap_set_mapping(const struct id_map
*id
)
1524 if (! NT_STATUS_IS_OK(ret
= idmap_init())) {
1529 if ((id
->sid
== NULL
) || (id
->status
!= ID_MAPPED
)) {
1530 DEBUG(1, ("NULL SID or unmapped entry\n"));
1531 return NT_STATUS_INVALID_PARAMETER
;
1534 /* TODO: check uid/gid range ? */
1536 ctx
= talloc_named_const(NULL
, 0, "idmap_set_mapping ctx");
1538 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1539 return NT_STATUS_NO_MEMORY
;
1542 /* set the new mapping */
1543 ret
= idmap_backends_set_mapping(id
);
1544 IDMAP_CHECK_RET(ret
);
1546 /* set the mapping in the cache */
1547 ret
= idmap_cache_set(idmap_cache
, id
);
1548 IDMAP_CHECK_RET(ret
);
1555 char *idmap_fetch_secret(const char *backend
, bool alloc
,
1556 const char *domain
, const char *identity
)
1562 r
= asprintf(&tmp
, "IDMAP_ALLOC_%s", backend
);
1564 r
= asprintf(&tmp
, "IDMAP_%s_%s", backend
, domain
);
1570 strupper_m(tmp
); /* make sure the key is case insensitive */
1571 ret
= secrets_fetch_generic(tmp
, identity
);