source3/winbindd/idmap_ad.c

   1 /*
   2  * idmap_ad: map between Active Directory and RFC 2307 accounts
   3  *
   4  * Copyright (C) Volker Lendecke 2015
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; either version 3 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21 #include "winbindd.h"
  22 #include "libsmb/namequery.h"
  23 #include "idmap.h"
  24 #include "tldap_gensec_bind.h"
  25 #include "tldap_util.h"
  26 #include "passdb.h"
  27 #include "lib/param/param.h"
  28 #include "utils/net.h"
  29 #include "auth/gensec/gensec.h"
  30 #include "librpc/gen_ndr/ndr_netlogon.h"
  31 #include "libads/ldap_schema_oids.h"
  32 #include "../libds/common/flags.h"
  33 #include "libcli/ldap/ldap_ndr.h"
  34 #include "libcli/security/dom_sid.h"
  35
  36 struct idmap_ad_schema_names;
  37
  38 struct idmap_ad_context {
  39         struct idmap_domain *dom;
  40         struct tldap_context *ld;
  41         struct idmap_ad_schema_names *schema;
  42         const char *default_nc;
  43
  44         bool unix_primary_group;
  45         bool unix_nss_info;
  46 };
  47
  48 static NTSTATUS idmap_ad_get_context(struct idmap_domain *dom,
  49                                      struct idmap_ad_context **pctx);
  50
  51 static char *get_schema_path(TALLOC_CTX *mem_ctx, struct tldap_context *ld)
  52 {
  53         struct tldap_message *rootdse;
  54
  55         rootdse = tldap_rootdse(ld);
  56         if (rootdse == NULL) {
  57                 return NULL;
  58         }
  59
  60         return tldap_talloc_single_attribute(rootdse, "schemaNamingContext",
  61                                              mem_ctx);
  62 }
  63
  64 static char *get_default_nc(TALLOC_CTX *mem_ctx, struct tldap_context *ld)
  65 {
  66         struct tldap_message *rootdse;
  67
  68         rootdse = tldap_rootdse(ld);
  69         if (rootdse == NULL) {
  70                 return NULL;
  71         }
  72
  73         return tldap_talloc_single_attribute(rootdse, "defaultNamingContext",
  74                                              mem_ctx);
  75 }
  76
  77 struct idmap_ad_schema_names {
  78         char *name;
  79         char *uid;
  80         char *gid;
  81         char *gecos;
  82         char *dir;
  83         char *shell;
  84 };
  85
  86 static TLDAPRC get_attrnames_by_oids(struct tldap_context *ld,
  87                                      TALLOC_CTX *mem_ctx,
  88                                      const char *schema_path,
  89                                      size_t num_oids,
  90                                      const char **oids,
  91                                      char **names)
  92 {
  93         char *filter;
  94         const char *attrs[] = { "lDAPDisplayName", "attributeId" };
  95         size_t i;
  96         TLDAPRC rc;
  97         struct tldap_message **msgs;
  98         size_t num_msgs;
  99
 100         filter = talloc_strdup(mem_ctx, "(|");
 101         if (filter == NULL) {
 102                 return TLDAP_NO_MEMORY;
 103         }
 104
 105         for (i=0; i<num_oids; i++) {
 106                 filter = talloc_asprintf_append_buffer(
 107                         filter, "(attributeId=%s)", oids[i]);
 108                 if (filter == NULL) {
 109                         return TLDAP_NO_MEMORY;
 110                 }
 111         }
 112
 113         filter = talloc_asprintf_append_buffer(filter, ")");
 114         if (filter == NULL) {
 115                 return TLDAP_NO_MEMORY;
 116         }
 117
 118         rc = tldap_search(ld, schema_path, TLDAP_SCOPE_SUB, filter,
 119                           attrs, ARRAY_SIZE(attrs), 0, NULL, 0, NULL, 0,
 120                           0, 0, 0, mem_ctx, &msgs);;
 121         TALLOC_FREE(filter);
 122         if (!TLDAP_RC_IS_SUCCESS(rc)) {
 123                 return rc;
 124         }
 125
 126         for (i=0; i<num_oids; i++) {
 127                 names[i] = NULL;
 128         }
 129
 130         num_msgs = talloc_array_length(msgs);
 131
 132         for (i=0; i<num_msgs; i++) {
 133                 struct tldap_message *msg = msgs[i];
 134                 char *oid;
 135                 size_t j;
 136
 137                 if (tldap_msg_type(msg) != TLDAP_RES_SEARCH_ENTRY) {
 138                         /* Could be a TLDAP_RES_SEARCH_REFERENCE */
 139                         continue;
 140                 }
 141
 142                 oid = tldap_talloc_single_attribute(
 143                         msg, "attributeId", msg);
 144                 if (oid == NULL) {
 145                         continue;
 146                 }
 147
 148                 for (j=0; j<num_oids; j++) {
 149                         if (strequal(oid, oids[j])) {
 150                                 break;
 151                         }
 152                 }
 153                 TALLOC_FREE(oid);
 154
 155                 if (j == num_oids) {
 156                         /* not found */
 157                         continue;
 158                 }
 159
 160                 names[j] = tldap_talloc_single_attribute(
 161                         msg, "lDAPDisplayName", mem_ctx);
 162         }
 163
 164         TALLOC_FREE(msgs);
 165         for (i=0; i<num_oids; i++) {
 166                 if (names[i] == NULL) {
 167                         DBG_ERR("Failed to retrieve schema name for "
 168                                 "oid [%s]. Schema mode is incorrect "
 169                                 "for this domain.\n", oids[i]);
 170                         return TLDAP_FILTER_ERROR;
 171                 }
 172         }
 173
 174         return TLDAP_SUCCESS;
 175 }
 176
 177 static TLDAPRC get_posix_schema_names(struct tldap_context *ld,
 178                                       const char *schema_mode,
 179                                       TALLOC_CTX *mem_ctx,
 180                                       struct idmap_ad_schema_names **pschema)
 181 {
 182         char *schema_path;
 183         struct idmap_ad_schema_names *schema;
 184         char *names[6];
 185         const char *oids_sfu[] = {
 186                 ADS_ATTR_SFU_UIDNUMBER_OID,
 187                 ADS_ATTR_SFU_GIDNUMBER_OID,
 188                 ADS_ATTR_SFU_HOMEDIR_OID,
 189                 ADS_ATTR_SFU_SHELL_OID,
 190                 ADS_ATTR_SFU_GECOS_OID,
 191                 ADS_ATTR_SFU_UID_OID
 192         };
 193         const char *oids_sfu20[] = {
 194                 ADS_ATTR_SFU20_UIDNUMBER_OID,
 195                 ADS_ATTR_SFU20_GIDNUMBER_OID,
 196                 ADS_ATTR_SFU20_HOMEDIR_OID,
 197                 ADS_ATTR_SFU20_SHELL_OID,
 198                 ADS_ATTR_SFU20_GECOS_OID,
 199                 ADS_ATTR_SFU20_UID_OID
 200         };
 201         const char *oids_rfc2307[] = {
 202                 ADS_ATTR_RFC2307_UIDNUMBER_OID,
 203                 ADS_ATTR_RFC2307_GIDNUMBER_OID,
 204                 ADS_ATTR_RFC2307_HOMEDIR_OID,
 205                 ADS_ATTR_RFC2307_SHELL_OID,
 206                 ADS_ATTR_RFC2307_GECOS_OID,
 207                 ADS_ATTR_RFC2307_UID_OID
 208         };
 209         const char **oids;
 210
 211         TLDAPRC rc;
 212
 213         schema = talloc(mem_ctx, struct idmap_ad_schema_names);
 214         if (schema == NULL) {
 215                 return TLDAP_NO_MEMORY;
 216         }
 217
 218         schema_path = get_schema_path(schema, ld);
 219         if (schema_path == NULL) {
 220                 TALLOC_FREE(schema);
 221                 return TLDAP_NO_MEMORY;
 222         }
 223
 224         oids = oids_rfc2307;
 225
 226         if ((schema_mode != NULL) && (schema_mode[0] != '\0')) {
 227                 if (strequal(schema_mode, "sfu")) {
 228                         oids = oids_sfu;
 229                 } else if (strequal(schema_mode, "sfu20")) {
 230                         oids = oids_sfu20;
 231                 } else if (strequal(schema_mode, "rfc2307" )) {
 232                         oids = oids_rfc2307;
 233                 } else {
 234                         DBG_WARNING("Unknown schema mode %s\n", schema_mode);
 235                 }
 236         }
 237
 238         rc = get_attrnames_by_oids(ld, schema, schema_path, 6, oids, names);
 239         TALLOC_FREE(schema_path);
 240         if (!TLDAP_RC_IS_SUCCESS(rc)) {
 241                 TALLOC_FREE(schema);
 242                 return rc;
 243         }
 244
 245         schema->uid = names[0];
 246         schema->gid = names[1];
 247         schema->dir = names[2];
 248         schema->shell = names[3];
 249         schema->gecos = names[4];
 250         schema->name = names[5];
 251
 252         *pschema = schema;
 253
 254         return TLDAP_SUCCESS;
 255 }
 256
 257 static void idmap_ad_tldap_debug(void *log_private,
 258                                  enum tldap_debug_level level,
 259                                  const char *fmt,
 260                                  va_list ap)
 261 {
 262        int samba_level = -1;
 263
 264        switch (level) {
 265        case TLDAP_DEBUG_FATAL:
 266                samba_level = DBGLVL_ERR;
 267                break;
 268        case TLDAP_DEBUG_ERROR:
 269                samba_level = DBGLVL_ERR;
 270                break;
 271        case TLDAP_DEBUG_WARNING:
 272                samba_level = DBGLVL_WARNING;
 273                break;
 274        case TLDAP_DEBUG_TRACE:
 275                samba_level = DBGLVL_DEBUG;
 276                break;
 277        }
 278
 279        if (CHECK_DEBUGLVL(samba_level)) {
 280                char *s = NULL;
 281                int ret;
 282
 283                ret = vasprintf(&s, fmt, ap);
 284                if (ret == -1) {
 285                        return;
 286                }
 287                DEBUG(samba_level, ("idmap_ad_tldap: %s", s));
 288                free(s);
 289        }
 290 }
 291
 292 static NTSTATUS idmap_ad_get_tldap_ctx(TALLOC_CTX *mem_ctx,
 293                                        const char *domname,
 294                                        struct tldap_context **pld)
 295 {
 296         struct netr_DsRGetDCNameInfo *dcinfo;
 297         struct sockaddr_storage dcaddr;
 298         struct cli_credentials *creds;
 299         struct loadparm_context *lp_ctx;
 300         struct tldap_context *ld;
 301         int fd;
 302         NTSTATUS status;
 303         bool ok;
 304         TLDAPRC rc;
 305
 306         status = wb_dsgetdcname_gencache_get(mem_ctx, domname, &dcinfo);
 307         if (!NT_STATUS_IS_OK(status)) {
 308                 DBG_DEBUG("Could not get dcinfo for %s: %s\n", domname,
 309                           nt_errstr(status));
 310                 return status;
 311         }
 312
 313         if (dcinfo->dc_unc == NULL) {
 314                 TALLOC_FREE(dcinfo);
 315                 return NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
 316         }
 317         if (dcinfo->dc_unc[0] == '\\') {
 318                 dcinfo->dc_unc += 1;
 319         }
 320         if (dcinfo->dc_unc[0] == '\\') {
 321                 dcinfo->dc_unc += 1;
 322         }
 323
 324         ok = resolve_name(dcinfo->dc_unc, &dcaddr, 0x20, true);
 325         if (!ok) {
 326                 DBG_DEBUG("Could not resolve name %s\n", dcinfo->dc_unc);
 327                 TALLOC_FREE(dcinfo);
 328                 return NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
 329         }
 330
 331         status = open_socket_out(&dcaddr, 389, 10000, &fd);
 332         if (!NT_STATUS_IS_OK(status)) {
 333                 DBG_DEBUG("open_socket_out failed: %s\n", nt_errstr(status));
 334                 TALLOC_FREE(dcinfo);
 335                 return status;
 336         }
 337
 338         ld = tldap_context_create(dcinfo, fd);
 339         if (ld == NULL) {
 340                 DBG_DEBUG("tldap_context_create failed\n");
 341                 close(fd);
 342                 TALLOC_FREE(dcinfo);
 343                 return NT_STATUS_NO_MEMORY;
 344         }
 345         tldap_set_debug(ld, idmap_ad_tldap_debug, NULL);
 346
 347         /*
 348          * Here we use or own machine account as
 349          * we run as domain member.
 350          */
 351         status = pdb_get_trust_credentials(lp_workgroup(),
 352                                            lp_realm(),
 353                                            dcinfo,
 354                                            &creds);
 355         if (!NT_STATUS_IS_OK(status)) {
 356                 DBG_DEBUG("pdb_get_trust_credentials() failed - %s\n",
 357                           nt_errstr(status));
 358                 TALLOC_FREE(dcinfo);
 359                 return status;
 360         }
 361
 362         lp_ctx = loadparm_init_s3(dcinfo, loadparm_s3_helpers());
 363         if (lp_ctx == NULL) {
 364                 DBG_DEBUG("loadparm_init_s3 failed\n");
 365                 TALLOC_FREE(dcinfo);
 366                 return NT_STATUS_NO_MEMORY;
 367         }
 368
 369         rc = tldap_gensec_bind(ld, creds, "ldap", dcinfo->dc_unc, NULL, lp_ctx,
 370                                GENSEC_FEATURE_SIGN | GENSEC_FEATURE_SEAL);
 371         if (!TLDAP_RC_IS_SUCCESS(rc)) {
 372                 DBG_DEBUG("tldap_gensec_bind failed: %s\n",
 373                           tldap_errstr(dcinfo, ld, rc));
 374                 TALLOC_FREE(dcinfo);
 375                 return NT_STATUS_LDAP(TLDAP_RC_V(rc));
 376         }
 377
 378         rc = tldap_fetch_rootdse(ld);
 379         if (!TLDAP_RC_IS_SUCCESS(rc)) {
 380                 DBG_DEBUG("tldap_fetch_rootdse failed: %s\n",
 381                           tldap_errstr(dcinfo, ld, rc));
 382                 TALLOC_FREE(dcinfo);
 383                 return NT_STATUS_LDAP(TLDAP_RC_V(rc));
 384         }
 385
 386         *pld = talloc_move(mem_ctx, &ld);
 387         TALLOC_FREE(dcinfo);
 388         return NT_STATUS_OK;
 389 }
 390
 391 static int idmap_ad_context_destructor(struct idmap_ad_context *ctx)
 392 {
 393         if ((ctx->dom != NULL) && (ctx->dom->private_data == ctx)) {
 394                 ctx->dom->private_data = NULL;
 395         }
 396         return 0;
 397 }
 398
 399 static NTSTATUS idmap_ad_context_create(TALLOC_CTX *mem_ctx,
 400                                         struct idmap_domain *dom,
 401                                         const char *domname,
 402                                         struct idmap_ad_context **pctx)
 403 {
 404         struct idmap_ad_context *ctx;
 405         const char *schema_mode;
 406         NTSTATUS status;
 407         TLDAPRC rc;
 408
 409         ctx = talloc(mem_ctx, struct idmap_ad_context);
 410         if (ctx == NULL) {
 411                 return NT_STATUS_NO_MEMORY;
 412         }
 413         ctx->dom = dom;
 414
 415         talloc_set_destructor(ctx, idmap_ad_context_destructor);
 416
 417         status = idmap_ad_get_tldap_ctx(ctx, domname, &ctx->ld);
 418         if (!NT_STATUS_IS_OK(status)) {
 419                 DBG_DEBUG("idmap_ad_get_tldap_ctx failed: %s\n",
 420                           nt_errstr(status));
 421                 TALLOC_FREE(ctx);
 422                 return status;
 423         }
 424
 425         ctx->default_nc = get_default_nc(ctx, ctx->ld);
 426         if (ctx->default_nc == NULL) {
 427                 DBG_DEBUG("No default nc\n");
 428                 TALLOC_FREE(ctx);
 429                 return status;
 430         }
 431
 432         ctx->unix_primary_group = idmap_config_bool(
 433                 domname, "unix_primary_group", false);
 434         ctx->unix_nss_info = idmap_config_bool(
 435                 domname, "unix_nss_info", false);
 436
 437         schema_mode = idmap_config_const_string(
 438                 domname, "schema_mode", "rfc2307");
 439
 440         rc = get_posix_schema_names(ctx->ld, schema_mode, ctx, &ctx->schema);
 441         if (!TLDAP_RC_IS_SUCCESS(rc)) {
 442                 DBG_DEBUG("get_posix_schema_names failed: %s\n",
 443                           tldap_errstr(ctx, ctx->ld, rc));
 444                 TALLOC_FREE(ctx);
 445                 return NT_STATUS_LDAP(TLDAP_RC_V(rc));
 446         }
 447
 448         *pctx = ctx;
 449         return NT_STATUS_OK;
 450 }
 451
 452 static NTSTATUS idmap_ad_query_user(struct idmap_domain *domain,
 453                                     struct wbint_userinfo *info)
 454 {
 455         struct idmap_ad_context *ctx;
 456         TLDAPRC rc;
 457         NTSTATUS status;
 458         char *sidstr, *filter;
 459         const char *attrs[4];
 460         size_t i, num_msgs;
 461         struct tldap_message **msgs;
 462
 463         status = idmap_ad_get_context(domain, &ctx);
 464         if (!NT_STATUS_IS_OK(status)) {
 465                 return status;
 466         }
 467
 468         if (!(ctx->unix_primary_group || ctx->unix_nss_info)) {
 469                 return NT_STATUS_OK;
 470         }
 471
 472         attrs[0] = ctx->schema->gid;
 473         attrs[1] = ctx->schema->gecos;
 474         attrs[2] = ctx->schema->dir;
 475         attrs[3] = ctx->schema->shell;
 476
 477         sidstr = ldap_encode_ndr_dom_sid(talloc_tos(), &info->user_sid);
 478         if (sidstr == NULL) {
 479                 return NT_STATUS_NO_MEMORY;
 480         }
 481
 482         filter = talloc_asprintf(talloc_tos(), "(objectsid=%s)", sidstr);
 483         TALLOC_FREE(sidstr);
 484         if (filter == NULL) {
 485                 return NT_STATUS_NO_MEMORY;
 486         }
 487
 488         DBG_DEBUG("Filter: [%s]\n", filter);
 489
 490         rc = tldap_search(ctx->ld, ctx->default_nc, TLDAP_SCOPE_SUB, filter,
 491                           attrs, ARRAY_SIZE(attrs), 0, NULL, 0, NULL, 0,
 492                           0, 0, 0, talloc_tos(), &msgs);
 493         if (!TLDAP_RC_IS_SUCCESS(rc)) {
 494                 return NT_STATUS_LDAP(TLDAP_RC_V(rc));
 495         }
 496
 497         TALLOC_FREE(filter);
 498
 499         num_msgs = talloc_array_length(msgs);
 500
 501         for (i=0; i<num_msgs; i++) {
 502                 struct tldap_message *msg = msgs[i];
 503
 504                 if (tldap_msg_type(msg) != TLDAP_RES_SEARCH_ENTRY) {
 505                         continue;
 506                 }
 507
 508                 if (ctx->unix_primary_group) {
 509                         bool ok;
 510                         uint32_t gid;
 511
 512                         ok = tldap_pull_uint32(msg, ctx->schema->gid, &gid);
 513                         if (ok) {
 514                                 DBG_DEBUG("Setting primary group "
 515                                           "to %"PRIu32" from attr %s\n",
 516                                           gid, ctx->schema->gid);
 517                                 info->primary_gid = gid;
 518                         }
 519                 }
 520
 521                 if (ctx->unix_nss_info) {
 522                         char *attr;
 523
 524                         attr = tldap_talloc_single_attribute(
 525                                 msg, ctx->schema->dir, talloc_tos());
 526                         if (attr != NULL) {
 527                                 info->homedir = talloc_move(info, &attr);
 528                         }
 529                         TALLOC_FREE(attr);
 530
 531                         attr = tldap_talloc_single_attribute(
 532                                 msg, ctx->schema->shell, talloc_tos());
 533                         if (attr != NULL) {
 534                                 info->shell = talloc_move(info, &attr);
 535                         }
 536                         TALLOC_FREE(attr);
 537
 538                         attr = tldap_talloc_single_attribute(
 539                                 msg, ctx->schema->gecos, talloc_tos());
 540                         if (attr != NULL) {
 541                                 info->full_name = talloc_move(info, &attr);
 542                         }
 543                         TALLOC_FREE(attr);
 544                 }
 545         }
 546
 547         return NT_STATUS_OK;
 548 }
 549
 550 static NTSTATUS idmap_ad_query_user_retry(struct idmap_domain *domain,
 551                                           struct wbint_userinfo *info)
 552 {
 553         const NTSTATUS status_server_down =
 554                 NT_STATUS_LDAP(TLDAP_RC_V(TLDAP_SERVER_DOWN));
 555         NTSTATUS status;
 556
 557         status = idmap_ad_query_user(domain, info);
 558
 559         if (NT_STATUS_EQUAL(status, status_server_down)) {
 560                 TALLOC_FREE(domain->private_data);
 561                 status = idmap_ad_query_user(domain, info);
 562         }
 563
 564         return status;
 565 }
 566
 567 static NTSTATUS idmap_ad_initialize(struct idmap_domain *dom)
 568 {
 569         dom->query_user = idmap_ad_query_user_retry;
 570         dom->private_data = NULL;
 571         return NT_STATUS_OK;
 572 }
 573
 574 static NTSTATUS idmap_ad_get_context(struct idmap_domain *dom,
 575                                      struct idmap_ad_context **pctx)
 576 {
 577         struct idmap_ad_context *ctx = NULL;
 578         NTSTATUS status;
 579
 580         if (IS_AD_DC) {
 581                 /*
 582                  * Make sure we never try to use LDAP against
 583                  * a trusted domain as AD_DC.
 584                  *
 585                  * This shouldn't be called currently,
 586                  * but you never know what happens in future.
 587                  */
 588                 return NT_STATUS_REQUEST_NOT_ACCEPTED;
 589         }
 590
 591         if (dom->private_data != NULL) {
 592                 *pctx = talloc_get_type_abort(dom->private_data,
 593                                               struct idmap_ad_context);
 594                 return NT_STATUS_OK;
 595         }
 596
 597         status = idmap_ad_context_create(dom, dom, dom->name, &ctx);
 598         if (!NT_STATUS_IS_OK(status)) {
 599                 DBG_DEBUG("idmap_ad_context_create failed: %s\n",
 600                           nt_errstr(status));
 601                 return status;
 602         }
 603
 604         dom->private_data = ctx;
 605         *pctx = ctx;
 606         return NT_STATUS_OK;
 607 }
 608
 609 static NTSTATUS idmap_ad_unixids_to_sids(struct idmap_domain *dom,
 610                                          struct id_map **ids)
 611 {
 612         struct idmap_ad_context *ctx;
 613         TLDAPRC rc;
 614         NTSTATUS status;
 615         struct tldap_message **msgs;
 616
 617         size_t i, num_msgs;
 618         char *u_filter, *g_filter, *filter;
 619
 620         const char *attrs[] = {
 621                 "sAMAccountType",
 622                 "objectSid",
 623                 NULL, /* attr_uidnumber */
 624                 NULL, /* attr_gidnumber */
 625         };
 626
 627         status = idmap_ad_get_context(dom, &ctx);
 628         if (!NT_STATUS_IS_OK(status)) {
 629                 return status;
 630         }
 631
 632         attrs[2] = ctx->schema->uid;
 633         attrs[3] = ctx->schema->gid;
 634
 635         u_filter = talloc_strdup(talloc_tos(), "");
 636         if (u_filter == NULL) {
 637                 return NT_STATUS_NO_MEMORY;
 638         }
 639
 640         g_filter = talloc_strdup(talloc_tos(), "");
 641         if (g_filter == NULL) {
 642                 return NT_STATUS_NO_MEMORY;
 643         }
 644
 645         for (i=0; ids[i] != NULL; i++) {
 646                 struct id_map *id = ids[i];
 647
 648                 id->status = ID_UNKNOWN;
 649
 650                 switch (id->xid.type) {
 651                     case ID_TYPE_UID: {
 652                             u_filter = talloc_asprintf_append_buffer(
 653                                     u_filter, "(%s=%ju)", ctx->schema->uid,
 654                                     (uintmax_t)id->xid.id);
 655                             if (u_filter == NULL) {
 656                                     return NT_STATUS_NO_MEMORY;
 657                             }
 658                             break;
 659                     }
 660
 661                     case ID_TYPE_GID: {
 662                             g_filter = talloc_asprintf_append_buffer(
 663                                     g_filter, "(%s=%ju)", ctx->schema->gid,
 664                                     (uintmax_t)id->xid.id);
 665                             if (g_filter == NULL) {
 666                                     return NT_STATUS_NO_MEMORY;
 667                             }
 668                             break;
 669                     }
 670
 671                     default:
 672                             DBG_WARNING("Unknown id type: %u\n",
 673                                         (unsigned)id->xid.type);
 674                             break;
 675                 }
 676         }
 677
 678         filter = talloc_strdup(talloc_tos(), "(|");
 679         if (filter == NULL) {
 680                 return NT_STATUS_NO_MEMORY;
 681         }
 682
 683         if (*u_filter != '\0') {
 684                 filter = talloc_asprintf_append_buffer(
 685                         filter,
 686                         "(&(|(sAMAccountType=%d)(sAMAccountType=%d)"
 687                         "(sAMAccountType=%d))(|%s))",
 688                         ATYPE_NORMAL_ACCOUNT, ATYPE_WORKSTATION_TRUST,
 689                         ATYPE_INTERDOMAIN_TRUST, u_filter);
 690                 if (filter == NULL) {
 691                         return NT_STATUS_NO_MEMORY;
 692                 }
 693         }
 694         TALLOC_FREE(u_filter);
 695
 696         if (*g_filter != '\0') {
 697                 filter = talloc_asprintf_append_buffer(
 698                         filter,
 699                         "(&(|(sAMAccountType=%d)(sAMAccountType=%d))(|%s))",
 700                         ATYPE_SECURITY_GLOBAL_GROUP,
 701                         ATYPE_SECURITY_LOCAL_GROUP,
 702                         g_filter);
 703                 if (filter == NULL) {
 704                         return NT_STATUS_NO_MEMORY;
 705                 }
 706         }
 707         TALLOC_FREE(g_filter);
 708
 709         filter = talloc_asprintf_append_buffer(filter, ")");
 710         if (filter == NULL) {
 711                 return NT_STATUS_NO_MEMORY;
 712         }
 713
 714         DBG_DEBUG("Filter: [%s]\n", filter);
 715
 716         rc = tldap_search(ctx->ld, ctx->default_nc, TLDAP_SCOPE_SUB, filter,
 717                           attrs, ARRAY_SIZE(attrs), 0, NULL, 0, NULL, 0,
 718                           0, 0, 0, talloc_tos(), &msgs);
 719         if (!TLDAP_RC_IS_SUCCESS(rc)) {
 720                 return NT_STATUS_LDAP(TLDAP_RC_V(rc));
 721         }
 722
 723         TALLOC_FREE(filter);
 724
 725         num_msgs = talloc_array_length(msgs);
 726
 727         for (i=0; i<num_msgs; i++) {
 728                 struct tldap_message *msg = msgs[i];
 729                 char *dn;
 730                 struct id_map *map;
 731                 struct dom_sid sid;
 732                 size_t j;
 733                 bool ok;
 734                 uint32_t atype, xid;
 735                 enum id_type type;
 736                 struct dom_sid_buf sidbuf;
 737
 738                 if (tldap_msg_type(msg) != TLDAP_RES_SEARCH_ENTRY) {
 739                         continue;
 740                 }
 741
 742                 ok = tldap_entry_dn(msg, &dn);
 743                 if (!ok) {
 744                         DBG_DEBUG("No dn found in msg %zu\n", i);
 745                         continue;
 746                 }
 747
 748                 ok = tldap_pull_uint32(msg, "sAMAccountType", &atype);
 749                 if (!ok) {
 750                         DBG_DEBUG("No atype in object %s\n", dn);
 751                         continue;
 752                 }
 753
 754                 switch (atype & 0xF0000000) {
 755                     case ATYPE_SECURITY_GLOBAL_GROUP:
 756                     case ATYPE_SECURITY_LOCAL_GROUP:
 757                             type = ID_TYPE_GID;
 758                             break;
 759                     case ATYPE_NORMAL_ACCOUNT:
 760                     case ATYPE_WORKSTATION_TRUST:
 761                     case ATYPE_INTERDOMAIN_TRUST:
 762                             type = ID_TYPE_UID;
 763                             break;
 764                     default:
 765                             DBG_WARNING("unrecognized SAM account type %08x\n",
 766                                         atype);
 767                         continue;
 768                 }
 769
 770                 ok = tldap_pull_uint32(msg, (type == ID_TYPE_UID) ?
 771                                        ctx->schema->uid : ctx->schema->gid,
 772                                        &xid);
 773                 if (!ok) {
 774                         DBG_WARNING("No unix id in object %s\n", dn);
 775                         continue;
 776                 }
 777
 778                 ok = tldap_pull_binsid(msg, "objectSid", &sid);
 779                 if (!ok) {
 780                         DBG_DEBUG("No objectSid in object %s\n", dn);
 781                         continue;
 782                 }
 783
 784                 map = NULL;
 785                 for (j=0; ids[j]; j++) {
 786                         if ((type == ids[j]->xid.type) &&
 787                             (xid == ids[j]->xid.id)) {
 788                                 map = ids[j];
 789                                 break;
 790                         }
 791                 }
 792                 if (map == NULL) {
 793                         DBG_DEBUG("Got unexpected sid %s from object %s\n",
 794                                   dom_sid_str_buf(&sid, &sidbuf),
 795                                   dn);
 796                         continue;
 797                 }
 798
 799                 sid_copy(map->sid, &sid);
 800                 map->status = ID_MAPPED;
 801
 802                 DBG_DEBUG("Mapped %s -> %ju (%d)\n",
 803                           dom_sid_str_buf(map->sid, &sidbuf),
 804                           (uintmax_t)map->xid.id, map->xid.type);
 805         }
 806
 807         TALLOC_FREE(msgs);
 808
 809         return NT_STATUS_OK;
 810 }
 811
 812 static NTSTATUS idmap_ad_sids_to_unixids(struct idmap_domain *dom,
 813                                          struct id_map **ids)
 814 {
 815         struct idmap_ad_context *ctx;
 816         TLDAPRC rc;
 817         NTSTATUS status;
 818         struct tldap_message **msgs;
 819
 820         char *filter;
 821         size_t i, num_msgs;
 822
 823         const char *attrs[] = {
 824                 "sAMAccountType",
 825                 "objectSid",
 826                 NULL, /* attr_uidnumber */
 827                 NULL, /* attr_gidnumber */
 828         };
 829
 830         status = idmap_ad_get_context(dom, &ctx);
 831         if (!NT_STATUS_IS_OK(status)) {
 832                 return status;
 833         }
 834
 835         attrs[2] = ctx->schema->uid;
 836         attrs[3] = ctx->schema->gid;
 837
 838         filter = talloc_asprintf(
 839                 talloc_tos(),
 840                 "(&(|(sAMAccountType=%d)(sAMAccountType=%d)(sAMAccountType=%d)"
 841                 "(sAMAccountType=%d)(sAMAccountType=%d))(|",
 842                 ATYPE_NORMAL_ACCOUNT, ATYPE_WORKSTATION_TRUST,
 843                 ATYPE_INTERDOMAIN_TRUST, ATYPE_SECURITY_GLOBAL_GROUP,
 844                 ATYPE_SECURITY_LOCAL_GROUP);
 845         if (filter == NULL) {
 846                 return NT_STATUS_NO_MEMORY;
 847         }
 848
 849         for (i=0; ids[i]; i++) {
 850                 char *sidstr;
 851
 852                 ids[i]->status = ID_UNKNOWN;
 853
 854                 sidstr = ldap_encode_ndr_dom_sid(talloc_tos(), ids[i]->sid);
 855                 if (sidstr == NULL) {
 856                         return NT_STATUS_NO_MEMORY;
 857                 }
 858
 859                 filter = talloc_asprintf_append_buffer(
 860                         filter, "(objectSid=%s)", sidstr);
 861                 TALLOC_FREE(sidstr);
 862                 if (filter == NULL) {
 863                         return NT_STATUS_NO_MEMORY;
 864                 }
 865         }
 866
 867         filter = talloc_asprintf_append_buffer(filter, "))");
 868         if (filter == NULL) {
 869                 return NT_STATUS_NO_MEMORY;
 870         }
 871
 872         DBG_DEBUG("Filter: [%s]\n", filter);
 873
 874         rc = tldap_search(ctx->ld, ctx->default_nc, TLDAP_SCOPE_SUB, filter,
 875                           attrs, ARRAY_SIZE(attrs), 0, NULL, 0, NULL, 0,
 876                           0, 0, 0, talloc_tos(), &msgs);
 877         if (!TLDAP_RC_IS_SUCCESS(rc)) {
 878                 return NT_STATUS_LDAP(TLDAP_RC_V(rc));
 879         }
 880
 881         TALLOC_FREE(filter);
 882
 883         num_msgs = talloc_array_length(msgs);
 884
 885         for (i=0; i<num_msgs; i++) {
 886                 struct tldap_message *msg = msgs[i];
 887                 char *dn;
 888                 struct id_map *map;
 889                 struct dom_sid sid;
 890                 size_t j;
 891                 bool ok;
 892                 uint64_t account_type, xid;
 893                 enum id_type type;
 894                 struct dom_sid_buf buf;
 895
 896                 if (tldap_msg_type(msg) != TLDAP_RES_SEARCH_ENTRY) {
 897                         continue;
 898                 }
 899
 900                 ok = tldap_entry_dn(msg, &dn);
 901                 if (!ok) {
 902                         DBG_DEBUG("No dn found in msg %zu\n", i);
 903                         continue;
 904                 }
 905
 906                 ok = tldap_pull_binsid(msg, "objectSid", &sid);
 907                 if (!ok) {
 908                         DBG_DEBUG("No objectSid in object %s\n", dn);
 909                         continue;
 910                 }
 911
 912                 map = NULL;
 913                 for (j=0; ids[j]; j++) {
 914                         if (dom_sid_equal(&sid, ids[j]->sid)) {
 915                                 map = ids[j];
 916                                 break;
 917                         }
 918                 }
 919                 if (map == NULL) {
 920                         DBG_DEBUG("Got unexpected sid %s from object %s\n",
 921                                   dom_sid_str_buf(&sid, &buf),
 922                                   dn);
 923                         continue;
 924                 }
 925
 926                 ok = tldap_pull_uint64(msg, "sAMAccountType", &account_type);
 927                 if (!ok) {
 928                         DBG_DEBUG("No sAMAccountType in %s\n", dn);
 929                         continue;
 930                 }
 931
 932                 switch (account_type & 0xF0000000) {
 933                 case ATYPE_SECURITY_GLOBAL_GROUP:
 934                 case ATYPE_SECURITY_LOCAL_GROUP:
 935                         type = ID_TYPE_GID;
 936                         break;
 937                 case ATYPE_NORMAL_ACCOUNT:
 938                 case ATYPE_WORKSTATION_TRUST:
 939                 case ATYPE_INTERDOMAIN_TRUST:
 940                         type = ID_TYPE_UID;
 941                         break;
 942                 default:
 943                         DBG_WARNING("unrecognized SAM account type %"PRIu64"\n",
 944                                     account_type);
 945                         continue;
 946                 }
 947
 948                 ok = tldap_pull_uint64(msg,
 949                                        type == ID_TYPE_UID ?
 950                                        ctx->schema->uid : ctx->schema->gid,
 951                                        &xid);
 952                 if (!ok) {
 953                         DBG_DEBUG("No xid in %s\n", dn);
 954                         continue;
 955                 }
 956
 957                 /* mapped */
 958                 map->xid.type = type;
 959                 map->xid.id = xid;
 960                 map->status = ID_MAPPED;
 961
 962                 DEBUG(10, ("Mapped %s -> %lu (%d)\n",
 963                            dom_sid_str_buf(map->sid, &buf),
 964                            (unsigned long)map->xid.id, map->xid.type));
 965         }
 966
 967         TALLOC_FREE(msgs);
 968
 969         return NT_STATUS_OK;
 970 }
 971
 972 static NTSTATUS idmap_ad_unixids_to_sids_retry(struct idmap_domain *dom,
 973                                                struct id_map **ids)
 974 {
 975         const NTSTATUS status_server_down =
 976                 NT_STATUS_LDAP(TLDAP_RC_V(TLDAP_SERVER_DOWN));
 977         NTSTATUS status;
 978
 979         status = idmap_ad_unixids_to_sids(dom, ids);
 980
 981         if (NT_STATUS_EQUAL(status, status_server_down)) {
 982                 TALLOC_FREE(dom->private_data);
 983                 status = idmap_ad_unixids_to_sids(dom, ids);
 984         }
 985
 986         return status;
 987 }
 988
 989 static NTSTATUS idmap_ad_sids_to_unixids_retry(struct idmap_domain *dom,
 990                                                struct id_map **ids)
 991 {
 992         const NTSTATUS status_server_down =
 993                 NT_STATUS_LDAP(TLDAP_RC_V(TLDAP_SERVER_DOWN));
 994         NTSTATUS status;
 995
 996         status = idmap_ad_sids_to_unixids(dom, ids);
 997
 998         if (NT_STATUS_EQUAL(status, status_server_down)) {
 999                 TALLOC_FREE(dom->private_data);
1000                 status = idmap_ad_sids_to_unixids(dom, ids);
1001         }
1002
1003         return status;
1004 }
1005
1006 static struct idmap_methods ad_methods = {
1007         .init            = idmap_ad_initialize,
1008         .unixids_to_sids = idmap_ad_unixids_to_sids_retry,
1009         .sids_to_unixids = idmap_ad_sids_to_unixids_retry,
1010 };
1011
1012 static_decl_idmap;
1013 NTSTATUS idmap_ad_init(TALLOC_CTX *ctx)
1014 {
1015         NTSTATUS status;
1016
1017         status = smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION,
1018                                     "ad", &ad_methods);
1019         if (!NT_STATUS_IS_OK(status)) {
1020                 return status;
1021         }
1022
1023         status = idmap_ad_nss_init(ctx);
1024         if (!NT_STATUS_IS_OK(status)) {
1025                 return status;
1026         }
1027
1028         return NT_STATUS_OK;
1029 }