2 * idmap_rid: static map between Active Directory/NT RIDs and RFC 2307 accounts
3 * Copyright (C) Guenther Deschner, 2004
4 * Copyright (C) Sumit Bose, 2004
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
25 #define DBGC_CLASS DBGC_IDMAP
27 #define IDMAP_RID_SUPPORT_TRUSTED_DOMAINS 0
29 NTSTATUS
init_module(void);
38 typedef struct trust_dom_array
{
40 struct dom_entry
*dom
;
43 static trust_dom_array trust
;
45 static NTSTATUS
rid_idmap_parse(const char *init_param
,
47 fstring
*domain_names
,
56 BOOL known_domain
= False
;
60 /* falling back to automatic mapping when there were no options given */
63 DEBUG(3,("rid_idmap_parse: no domain list given or trusted domain-support deactivated, falling back to automatic mapping for own domain:\n"));
65 sid_to_string(sid_str
, &domain_sids
[0]);
67 fstrcpy(trust
.dom
[0].name
, domain_names
[0]);
68 fstrcpy(trust
.dom
[0].sid
, sid_str
);
69 trust
.dom
[0].min_id
= u_low
;
70 trust
.dom
[0].max_id
= u_high
;
73 DEBUGADD(3,("rid_idmap_parse:\tdomain: [%s], sid: [%s], range=[%d-%d]\n",
74 trust
.dom
[0].name
, trust
.dom
[0].sid
, trust
.dom
[0].min_id
, trust
.dom
[0].max_id
));
78 /* scan through the init_param-list */
79 while (next_token(&init_param
, tok
, LIST_SEP
, sizeof(tok
))) {
82 DEBUG(3,("rid_idmap_parse: parsing entry: %d\n", trust
.number
));
85 trust
.dom
= (struct dom_entry
*) realloc(trust
.dom
, sizeof(struct dom_entry
)*(trust
.number
+1));
87 if ( trust
.dom
== NULL
) {
88 return NT_STATUS_NO_MEMORY
;
91 if (!next_token(&p
, tok
, "=", sizeof(tok
))) {
92 DEBUG(0, ("rid_idmap_parse: no '=' sign found in domain list [%s]\n", init_param
));
93 return NT_STATUS_UNSUCCESSFUL
;
97 fstrcpy(trust
.dom
[trust
.number
].name
, tok
);
98 DEBUGADD(3,("rid_idmap_parse:\tentry %d has name: [%s]\n", trust
.number
, trust
.dom
[trust
.number
].name
));
100 /* add the domain-sid */
101 for (i
=0; i
<num_domains
; i
++) {
103 known_domain
= False
;
105 if (strequal(domain_names
[i
], trust
.dom
[trust
.number
].name
)) {
107 sid_to_string(sid_str
, &domain_sids
[i
]);
108 fstrcpy(trust
.dom
[trust
.number
].sid
, sid_str
);
110 DEBUGADD(3,("rid_idmap_parse:\tentry %d has sid: [%s]\n", trust
.number
, trust
.dom
[trust
.number
].sid
));
117 DEBUG(0,("rid_idmap_parse: your DC does not know anything about domain: [%s]\n", trust
.dom
[trust
.number
].name
));
118 return NT_STATUS_INVALID_PARAMETER
;
121 if (!next_token(&p
, tok
, "-", sizeof(tok
))) {
122 DEBUG(0,("rid_idmap_parse: no mapping-range defined\n"));
123 return NT_STATUS_INVALID_PARAMETER
;
127 trust
.dom
[trust
.number
].min_id
= atoi(tok
);
128 DEBUGADD(3,("rid_idmap_parse:\tentry %d has min_id: [%d]\n", trust
.number
, trust
.dom
[trust
.number
].min_id
));
131 trust
.dom
[trust
.number
].max_id
= atoi(p
);
132 DEBUGADD(3,("rid_idmap_parse:\tentry %d has max_id: [%d]\n", trust
.number
, trust
.dom
[trust
.number
].max_id
));
141 static NTSTATUS
rid_idmap_get_domains(uint32
*num_domains
, fstring
**domain_names
, DOM_SID
**domain_sids
)
143 NTSTATUS status
= NT_STATUS_UNSUCCESSFUL
;
144 struct cli_state
*cli
;
147 uint32 des_access
= SEC_RIGHTS_MAXIMUM_ALLOWED
;
149 struct in_addr dc_ip
;
150 char *password
= NULL
;
151 char *username
= NULL
;
153 uint32 info_class
= 5;
154 char *domain_name
= NULL
;
155 DOM_SID
*domain_sid
, sid
;
158 uint32 trusted_num_domains
= 0;
159 char **trusted_domain_names
;
160 DOM_SID
*trusted_domain_sids
;
164 /* put the results together */
166 *domain_names
= (fstring
*) malloc(sizeof(fstring
) * *num_domains
);
167 *domain_sids
= (DOM_SID
*) malloc(sizeof(DOM_SID
) * *num_domains
);
169 /* avoid calling a DC when trusted domains are not allowed anyway */
170 if (!lp_allow_trusted_domains()) {
172 fstrcpy((*domain_names
)[0], lp_workgroup());
173 if (!secrets_fetch_domain_sid(lp_workgroup(), &sid
)) {
174 DEBUG(0,("rid_idmap_get_domains: failed to retrieve domain sid\n"));
177 sid_copy(&(*domain_sids
)[0], &sid
);
183 if (!(mem_ctx
= talloc_init("rid_idmap_get_trusted_domains"))) {
184 DEBUG(0, ("rid_idmap_get_domains: talloc_init() failed\n"));
185 return NT_STATUS_NO_MEMORY
;
188 if (!get_dc_name(lp_workgroup(), 0, dc_name
, &dc_ip
)) {
189 DEBUG(1, ("rid_idmap_get_domains: could not get dc-name\n"));
190 return NT_STATUS_UNSUCCESSFUL
;
193 /* open a connection to the dc */
194 username
= secrets_fetch(SECRETS_AUTH_USER
, NULL
);
195 password
= secrets_fetch(SECRETS_AUTH_PASSWORD
, NULL
);
196 domain
= secrets_fetch(SECRETS_AUTH_DOMAIN
, NULL
);
201 domain
= smb_xstrdup(lp_workgroup());
204 password
= smb_xstrdup("");
206 DEBUG(3, ("rid_idmap_get_domains: IPC$ connections done by user %s\\%s\n", domain
, username
));
210 DEBUG(3, ("rid_idmap_get_domains: IPC$ connections done anonymously\n"));
216 DEBUG(10, ("rid_idmap_get_domains: opening connection to [%s]\n", dc_name
));
218 status
= cli_full_connection(&cli
, global_myname(), dc_name
,
224 CLI_FULL_CONNECTION_ANNONYMOUS_FALLBACK
, True
, NULL
);
226 if (!NT_STATUS_IS_OK(status
)) {
227 DEBUG(1, ("rid_idmap_get_domains: could not setup connection to dc\n"));
231 /* query the lsa-pipe */
232 if (!cli_nt_session_open (cli
, PI_LSARPC
)) {
233 DEBUG(1, ("rid_idmap_get_domains: could not setup connection to dc\n"));
238 status
= cli_lsa_open_policy(cli
, mem_ctx
, False
, des_access
, &pol
);
239 if (!NT_STATUS_IS_OK(status
)) {
243 status
= cli_lsa_query_info_policy(cli
, mem_ctx
, &pol
, info_class
, &domain_name
, &domain_sid
);
244 if (!NT_STATUS_IS_OK(status
)) {
245 DEBUG(1, ("rid_idmap_get_domains: cannot retrieve domain-info\n"));
249 sid_to_string(sid_str
, domain_sid
);
250 DEBUG(10,("rid_idmap_get_domains: my domain: [%s], sid: [%s]\n", domain_name
, sid_str
));
252 /* scan trusted domains */
253 DEBUG(10, ("rid_idmap_get_domains: enumerating trusted domains\n"));
254 status
= cli_lsa_enum_trust_dom(cli
, mem_ctx
, &pol
, &enum_ctx
,
255 &trusted_num_domains
,
256 &trusted_domain_names
,
257 &trusted_domain_sids
);
259 if (!NT_STATUS_IS_OK(status
) &&
260 !NT_STATUS_EQUAL(status
, NT_STATUS_NO_MORE_ENTRIES
) &&
261 !NT_STATUS_EQUAL(status
, STATUS_MORE_ENTRIES
)) {
262 DEBUG(1, ("rid_idmap_get_domains: could not enumerate trusted domains\n"));
266 /* show trusted domains */
267 DEBUG(10,("rid_idmap_get_domains: scan for trusted domains gave %d results:\n", trusted_num_domains
));
268 for (i
=0; i
<trusted_num_domains
; i
++) {
269 sid_to_string(sid_str
, &trusted_domain_sids
[i
]);
270 DEBUGADD(10,("rid_idmap_get_domains:\t#%d\tDOMAIN: [%s], SID: [%s]\n",
271 i
, trusted_domain_names
[i
], sid_str
));
274 /* put the results together */
275 *num_domains
= trusted_num_domains
+ 2;
276 *domain_names
= (fstring
*) realloc(*domain_names
, sizeof(fstring
) * *num_domains
);
277 *domain_sids
= (DOM_SID
*) realloc(*domain_sids
, sizeof(DOM_SID
) * *num_domains
);
279 /* first add myself */
280 fstrcpy((*domain_names
)[0], domain_name
);
281 sid_copy(&(*domain_sids
)[0], domain_sid
);
283 /* then add BUILTIN */
284 string_to_sid(&builtin_sid
, "S-1-5-32");
285 fstrcpy((*domain_names
)[1], "BUILTIN");
286 sid_copy(&(*domain_sids
)[1], &builtin_sid
);
288 /* add trusted domains */
289 for (i
=0; i
<trusted_num_domains
; i
++) {
290 fstrcpy((*domain_names
)[i
+2], trusted_domain_names
[i
]);
291 sid_copy(&((*domain_sids
)[i
+2]), &(trusted_domain_sids
[i
]));
294 /* show complete domain list */
295 DEBUG(5,("rid_idmap_get_domains: complete domain-list has %d entries:\n", *num_domains
));
296 for (i
=0; i
<*num_domains
; i
++) {
297 sid_to_string(sid_str
, &((*domain_sids
)[i
]));
298 DEBUGADD(5,("rid_idmap_get_domains:\t#%d\tdomain: [%s], sid: [%s]\n",
299 i
, (*domain_names
)[i
], sid_str
));
302 status
= NT_STATUS_OK
;
305 cli_lsa_close(cli
, mem_ctx
, &pol
);
306 cli_nt_session_close(cli
);
307 talloc_destroy(mem_ctx
);
313 static NTSTATUS
rid_idmap_init(char *init_param
)
318 uint32 num_domains
= 0;
319 fstring
*domain_names
;
320 DOM_SID
*domain_sids
;
321 NTSTATUS nt_status
= NT_STATUS_INVALID_PARAMETER
;
324 /* basic sanity checks */
325 if (!lp_idmap_uid(&u_low
, &u_high
) || !lp_idmap_gid(&g_low
, &g_high
)) {
326 DEBUG(0, ("rid_idmap_init: cannot get required global idmap-ranges.\n"));
330 if (u_low
!= g_low
|| u_high
!= g_high
) {
331 DEBUG(0, ("rid_idmap_init: range defined in \"idmap uid\" must match range of \"idmap gid\".\n"));
335 if (lp_allow_trusted_domains()) {
336 #if IDMAP_RID_SUPPORT_TRUSTED_DOMAINS
337 DEBUG(3,("rid_idmap_init: enabling trusted-domain-mapping\n"));
339 DEBUG(0,("rid_idmap_init: idmap_rid does not work with trusted domains\n"));
340 DEBUGADD(0,("rid_idmap_init: please set \"allow trusted domains\" to \"no\" when using idmap_rid\n"));
346 trust
.dom
= (struct dom_entry
*) malloc(sizeof(struct dom_entry
));
347 if (trust
.dom
== NULL
) {
348 return NT_STATUS_NO_MEMORY
;
351 /* retrieve full domain list */
352 nt_status
= rid_idmap_get_domains(&num_domains
, &domain_names
, &domain_sids
);
353 if (!NT_STATUS_IS_OK(nt_status
) &&
354 !NT_STATUS_EQUAL(nt_status
, NT_STATUS_NO_MORE_ENTRIES
) &&
355 !NT_STATUS_EQUAL(nt_status
, STATUS_MORE_ENTRIES
)) {
356 DEBUG(0, ("rid_idmap_init: cannot fetch sids for domain and/or trusted-domains from domain-controller.\n"));
360 /* parse the init string */
361 nt_status
= rid_idmap_parse(init_param
, num_domains
, domain_names
, domain_sids
, u_low
, u_high
);
362 if (!NT_STATUS_IS_OK(nt_status
)) {
363 DEBUG(0, ("rid_idmap_init: cannot parse module-configuration\n"));
367 nt_status
= NT_STATUS_INVALID_PARAMETER
;
369 /* some basic sanity checks */
370 for (i
=0; i
<trust
.number
; i
++) {
372 if (trust
.dom
[i
].min_id
> trust
.dom
[i
].max_id
) {
373 DEBUG(0, ("rid_idmap_init: min_id (%d) has to be smaller than max_id (%d) for domain [%s]\n",
374 trust
.dom
[i
].min_id
, trust
.dom
[i
].max_id
, trust
.dom
[i
].name
));
378 if (trust
.dom
[i
].min_id
< u_low
|| trust
.dom
[i
].max_id
> u_high
) {
379 DEBUG(0, ("rid_idmap_init: mapping of domain [%s] (%d-%d) has to fit into global idmap range (%d-%d).\n",
380 trust
.dom
[i
].name
, trust
.dom
[i
].min_id
, trust
.dom
[i
].max_id
, u_low
, u_high
));
385 /* check for overlaps */
386 for (i
=0; i
<trust
.number
-1; i
++) {
387 for (j
=i
+1; j
<trust
.number
; j
++) {
388 if (trust
.dom
[i
].min_id
<= trust
.dom
[j
].max_id
&& trust
.dom
[j
].min_id
<= trust
.dom
[i
].max_id
) {
389 DEBUG(0, ("rid_idmap_init: the ranges of domain [%s] and [%s] overlap\n",
390 trust
.dom
[i
+1].name
, trust
.dom
[i
].name
));
396 DEBUG(3, ("rid_idmap_init: using %d mappings:\n", trust
.number
));
397 for (i
=0; i
<trust
.number
; i
++) {
398 DEBUGADD(3, ("rid_idmap_init:\tdomain: [%s], sid: [%s], min_id: [%d], max_id: [%d]\n",
399 trust
.dom
[i
].name
, trust
.dom
[i
].sid
, trust
.dom
[i
].min_id
, trust
.dom
[i
].max_id
));
402 nt_status
= NT_STATUS_OK
;
405 SAFE_FREE(domain_names
);
406 SAFE_FREE(domain_sids
);
411 static NTSTATUS
rid_idmap_get_sid_from_id(DOM_SID
*sid
, unid_t unid
, int id_type
)
418 for (i
=0; i
<trust
.number
; i
++) {
419 if (trust
.dom
[i
].min_id
<= unid
.uid
&& trust
.dom
[i
].max_id
>= unid
.uid
)
423 if (i
== trust
.number
) {
424 DEBUG(0,("rid_idmap_get_sid_from_id: no suitable range available for id: %d\n", unid
.uid
));
425 return NT_STATUS_INVALID_PARAMETER
;
428 /* use lower-end of idmap-range as offset for users and groups*/
429 unid
.uid
-= trust
.dom
[i
].min_id
;
431 if (!trust
.dom
[i
].sid
)
432 return NT_STATUS_INVALID_PARAMETER
;
434 string_to_sid(&sidstr
, trust
.dom
[i
].sid
);
435 sid_copy(sid
, &sidstr
);
436 if (!sid_append_rid( sid
, (unsigned long)unid
.uid
)) {
437 DEBUG(0,("rid_idmap_get_sid_from_id: could not append rid to domain sid\n"));
438 return NT_STATUS_NO_MEMORY
;
441 DEBUG(3, ("rid_idmap_get_sid_from_id: mapped POSIX %s %d to SID [%s]\n",
442 (id_type
== ID_GROUPID
) ? "GID" : "UID", unid
.uid
,
443 sid_to_string(sid_string
, sid
)));
448 static NTSTATUS
rid_idmap_get_id_from_sid(unid_t
*unid
, int *id_type
, const DOM_SID
*sid
)
455 /* check if we have a mapping for the sid */
456 for (i
=0; i
<trust
.number
; i
++) {
457 if (!trust
.dom
[i
].sid
) {
458 return NT_STATUS_INVALID_PARAMETER
;
460 string_to_sid(&sidstr
, trust
.dom
[i
].sid
);
461 if ( sid_compare_domain(sid
, &sidstr
) == 0 )
465 if (i
== trust
.number
) {
466 DEBUG(0,("rid_idmap_get_id_from_sid: no suitable range available for sid: %s\n",
467 sid_string_static(sid
)));
468 return NT_STATUS_INVALID_PARAMETER
;
471 if (!sid_peek_rid(sid
, &rid
)) {
472 DEBUG(0,("rid_idmap_get_id_from_sid: could not peek rid\n"));
473 return NT_STATUS_INVALID_PARAMETER
;
476 /* use lower-end of idmap-range as offset for users and groups */
477 unid
->uid
= rid
+ trust
.dom
[i
].min_id
;
479 if (unid
->uid
> trust
.dom
[i
].max_id
) {
480 DEBUG(0,("rid_idmap_get_id_from_sid: rid: %d too high for mapping of domain: %s\n", rid
, trust
.dom
[i
].name
));
481 return NT_STATUS_INVALID_PARAMETER
;
483 if (unid
->uid
< trust
.dom
[i
].min_id
) {
484 DEBUG(0,("rid_idmap_get_id_from_sid: rid: %d too low for mapping of domain: %s\n", rid
, trust
.dom
[i
].name
));
485 return NT_STATUS_INVALID_PARAMETER
;
488 DEBUG(3,("rid_idmap_get_id_from_sid: mapped SID [%s] to POSIX %s %d\n",
489 sid_to_string(sid_string
, sid
),
490 (*id_type
== ID_GROUPID
) ? "GID" : "UID", unid
->uid
));
496 static NTSTATUS
rid_idmap_set_mapping(const DOM_SID
*sid
, unid_t id
, int id_type
)
498 return NT_STATUS_NOT_IMPLEMENTED
;
501 static NTSTATUS
rid_idmap_close(void)
503 SAFE_FREE(trust
.dom
);
508 static NTSTATUS
rid_idmap_allocate_rid(uint32
*rid
, int rid_type
)
510 return NT_STATUS_NOT_IMPLEMENTED
;
513 static NTSTATUS
rid_idmap_allocate_id(unid_t
*id
, int id_type
)
515 return NT_STATUS_NOT_IMPLEMENTED
;
518 static void rid_idmap_status(void)
520 DEBUG(0, ("RID IDMAP Status not available\n"));
523 static struct idmap_methods rid_methods
= {
525 rid_idmap_allocate_rid
,
526 rid_idmap_allocate_id
,
527 rid_idmap_get_sid_from_id
,
528 rid_idmap_get_id_from_sid
,
529 rid_idmap_set_mapping
,
534 NTSTATUS
init_module(void)
536 return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION
, "idmap_rid", &rid_methods
);