2 Unix SMB/CIFS implementation.
4 Copyright (C) Simo Sorce 2003
5 Copyright (C) Jeremy Allison 2006
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.*/
22 #include "winbindd_proto.h"
25 #define DBGC_CLASS DBGC_IDMAP
27 /*****************************************************************
28 Returns true if the request was for a specific domain, or
29 for a sid we are authoritative for - BUILTIN, or our own domain.
30 *****************************************************************/
32 static bool is_specific_domain_request(const char *dom_name
, DOM_SID
*sid
)
34 if (dom_name
&& dom_name
[0] != '\0') {
37 if (sid_check_is_in_builtin(sid
) ||
38 sid_check_is_in_our_domain(sid
)) {
44 /*****************************************************************
45 Returns the SID mapped to the given UID.
46 If mapping is not possible returns an error.
47 *****************************************************************/
49 NTSTATUS
idmap_uid_to_sid(const char *domname
, DOM_SID
*sid
, uid_t uid
)
55 DEBUG(10,("idmap_uid_to_sid: uid = [%lu], domain = '%s'\n",
56 (unsigned long)uid
, domname
?domname
:"NULL"));
58 if (winbindd_use_idmap_cache()
59 && idmap_cache_find_uid2sid(uid
, sid
, &expired
)) {
60 DEBUG(10, ("idmap_cache_find_uid2sid found %u%s\n",
62 expired
? " (expired)": ""));
63 if (expired
&& idmap_is_online()) {
64 DEBUG(10, ("revalidating expired entry\n"));
67 if (is_null_sid(sid
)) {
68 DEBUG(10, ("Returning negative cache entry\n"));
69 return NT_STATUS_NONE_MAPPED
;
71 DEBUG(10, ("Returning positive cache entry\n"));
77 map
.xid
.type
= ID_TYPE_UID
;
80 ret
= idmap_backends_unixid_to_sid(domname
, &map
);
81 if ( ! NT_STATUS_IS_OK(ret
)) {
82 DEBUG(10, ("error mapping uid [%lu]\n", (unsigned long)uid
));
86 if (map
.status
!= ID_MAPPED
) {
87 if (winbindd_use_idmap_cache()) {
88 struct dom_sid null_sid
;
89 ZERO_STRUCT(null_sid
);
90 idmap_cache_set_sid2uid(&null_sid
, uid
);
92 DEBUG(10, ("uid [%lu] not mapped\n", (unsigned long)uid
));
93 return NT_STATUS_NONE_MAPPED
;
96 if (winbindd_use_idmap_cache()) {
97 idmap_cache_set_sid2uid(sid
, uid
);
103 /*****************************************************************
104 Returns SID mapped to the given GID.
105 If mapping is not possible returns an error.
106 *****************************************************************/
108 NTSTATUS
idmap_gid_to_sid(const char *domname
, DOM_SID
*sid
, gid_t gid
)
114 DEBUG(10,("idmap_gid_to_sid: gid = [%lu], domain = '%s'\n",
115 (unsigned long)gid
, domname
?domname
:"NULL"));
117 if (winbindd_use_idmap_cache()
118 && idmap_cache_find_gid2sid(gid
, sid
, &expired
)) {
119 DEBUG(10, ("idmap_cache_find_gid2sid found %u%s\n",
121 expired
? " (expired)": ""));
122 if (expired
&& idmap_is_online()) {
123 DEBUG(10, ("revalidating expired entry\n"));
126 if (is_null_sid(sid
)) {
127 DEBUG(10, ("Returning negative cache entry\n"));
128 return NT_STATUS_NONE_MAPPED
;
130 DEBUG(10, ("Returning positive cache entry\n"));
136 map
.xid
.type
= ID_TYPE_GID
;
139 ret
= idmap_backends_unixid_to_sid(domname
, &map
);
140 if ( ! NT_STATUS_IS_OK(ret
)) {
141 DEBUG(10, ("error mapping gid [%lu]\n", (unsigned long)gid
));
145 if (map
.status
!= ID_MAPPED
) {
146 if (winbindd_use_idmap_cache()) {
147 struct dom_sid null_sid
;
148 ZERO_STRUCT(null_sid
);
149 idmap_cache_set_sid2uid(&null_sid
, gid
);
151 DEBUG(10, ("gid [%lu] not mapped\n", (unsigned long)gid
));
152 return NT_STATUS_NONE_MAPPED
;
155 if (winbindd_use_idmap_cache()) {
156 idmap_cache_set_sid2gid(sid
, gid
);
162 /*****************************************************************
163 Returns the UID mapped to the given SID.
164 If mapping is not possible or SID maps to a GID returns an error.
165 *****************************************************************/
167 NTSTATUS
idmap_sid_to_uid(const char *dom_name
, DOM_SID
*sid
, uid_t
*uid
)
173 DEBUG(10,("idmap_sid_to_uid: sid = [%s], domain = '%s'\n",
174 sid_string_dbg(sid
), dom_name
));
176 if (winbindd_use_idmap_cache()
177 && idmap_cache_find_sid2uid(sid
, uid
, &expired
)) {
178 DEBUG(10, ("idmap_cache_find_sid2uid found %d%s\n",
179 (int)(*uid
), expired
? " (expired)": ""));
180 if (expired
&& idmap_is_online()) {
181 DEBUG(10, ("revalidating expired entry\n"));
185 DEBUG(10, ("Returning negative cache entry\n"));
186 return NT_STATUS_NONE_MAPPED
;
188 DEBUG(10, ("Returning positive cache entry\n"));
194 map
.xid
.type
= ID_TYPE_UID
;
196 ret
= idmap_backends_sid_to_unixid(dom_name
, &map
);
198 if (NT_STATUS_IS_OK(ret
) && (map
.status
== ID_MAPPED
)) {
199 if (map
.xid
.type
!= ID_TYPE_UID
) {
200 DEBUG(10, ("sid [%s] not mapped to a uid "
206 if (winbindd_use_idmap_cache()) {
207 idmap_cache_set_sid2uid(sid
, -1);
209 return NT_STATUS_NONE_MAPPED
;
214 if (is_specific_domain_request(dom_name
, sid
)) {
216 * We had the task to go to a specific domain or
217 * a domain for which we are authoritative for and
218 * it could not answer our request. Fail.
220 if (winbindd_use_idmap_cache()) {
221 idmap_cache_set_sid2uid(sid
, -1);
223 return NT_STATUS_NONE_MAPPED
;
226 ret
= idmap_new_mapping(sid
, ID_TYPE_UID
, &map
.xid
);
228 if (!NT_STATUS_IS_OK(ret
)) {
229 DEBUG(10, ("idmap_new_mapping failed: %s\n",
231 if (winbindd_use_idmap_cache()) {
232 idmap_cache_set_sid2uid(sid
, -1);
238 *uid
= (uid_t
)map
.xid
.id
;
239 if (winbindd_use_idmap_cache()) {
240 idmap_cache_set_sid2uid(sid
, *uid
);
245 /*****************************************************************
246 Returns the GID mapped to the given SID.
247 If mapping is not possible or SID maps to a UID returns an error.
248 *****************************************************************/
250 NTSTATUS
idmap_sid_to_gid(const char *domname
, DOM_SID
*sid
, gid_t
*gid
)
256 DEBUG(10,("idmap_sid_to_gid: sid = [%s], domain = '%s'\n",
257 sid_string_dbg(sid
), domname
));
259 if (winbindd_use_idmap_cache()
260 && idmap_cache_find_sid2gid(sid
, gid
, &expired
)) {
261 DEBUG(10, ("idmap_cache_find_sid2gid found %d%s\n",
262 (int)(*gid
), expired
? " (expired)": ""));
263 if (expired
&& idmap_is_online()) {
264 DEBUG(10, ("revalidating expired entry\n"));
268 DEBUG(10, ("Returning negative cache entry\n"));
269 return NT_STATUS_NONE_MAPPED
;
271 DEBUG(10, ("Returning positive cache entry\n"));
277 map
.xid
.type
= ID_TYPE_GID
;
279 ret
= idmap_backends_sid_to_unixid(domname
, &map
);
280 if (NT_STATUS_IS_OK(ret
) && (map
.status
== ID_MAPPED
)) {
281 if (map
.xid
.type
!= ID_TYPE_GID
) {
282 DEBUG(10, ("sid [%s] not mapped to a gid "
288 if (winbindd_use_idmap_cache()) {
289 idmap_cache_set_sid2gid(sid
, -1);
291 return NT_STATUS_NONE_MAPPED
;
296 if (is_specific_domain_request(domname
, sid
)) {
298 * We had the task to go to a specific domain or
299 * a domain for which we are authoritative for and
300 * it could not answer our request. Fail.
302 if (winbindd_use_idmap_cache()) {
303 idmap_cache_set_sid2uid(sid
, -1);
305 return NT_STATUS_NONE_MAPPED
;
308 ret
= idmap_new_mapping(sid
, ID_TYPE_GID
, &map
.xid
);
310 if (!NT_STATUS_IS_OK(ret
)) {
311 DEBUG(10, ("idmap_new_mapping failed: %s\n",
313 if (winbindd_use_idmap_cache()) {
314 idmap_cache_set_sid2gid(sid
, -1);
321 if (winbindd_use_idmap_cache()) {
322 idmap_cache_set_sid2gid(sid
, *gid
);