?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
wbinfo: Add --unix-ids-to-sids
[Samba.git] / source3 / winbindd / idmap_ad.c
blobe5dea208436b718555873f58fd56818d45e6903a
1 /*
2 * idmap_ad: map between Active Directory and RFC 2307 or "Services for Unix" (SFU) Accounts
3 *
4 * Unix SMB/CIFS implementation.
5 *
6 * Winbind ADS backend functions
7 *
8 * Copyright (C) Andrew Tridgell 2001
9 * Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
10 * Copyright (C) Gerald (Jerry) Carter 2004-2007
11 * Copyright (C) Luke Howard 2001-2004
12 * Copyright (C) Michael Adam 2008,2010
13 *
14 * This program is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License as published by
16 * the Free Software Foundation; either version 3 of the License, or
17 * (at your option) any later version.
18 *
19 * This program is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU General Public License for more details.
23 *
24 * You should have received a copy of the GNU General Public License
25 * along with this program; if not, see <http://www.gnu.org/licenses/>.
26 */
27
28 #include "includes.h"
29 #include "winbindd.h"
30 #include "../libds/common/flags.h"
31 #include "ads.h"
32 #include "libads/ldap_schema.h"
33 #include "nss_info.h"
34 #include "idmap.h"
35 #include "../libcli/ldap/ldap_ndr.h"
36 #include "../libcli/security/security.h"
37
38 #undef DBGC_CLASS
39 #define DBGC_CLASS DBGC_IDMAP
40
41 #define CHECK_ALLOC_DONE(mem) do { \
42 if (!mem) { \
43 DEBUG(0, ("Out of memory!\n")); \
44 ret = NT_STATUS_NO_MEMORY; \
45 goto done; \
46 } \
47 } while (0)
48
49 struct idmap_ad_context {
50 ADS_STRUCT *ads;
51 struct posix_schema *ad_schema;
52 enum wb_posix_mapping ad_map_type; /* WB_POSIX_MAP_UNKNOWN */
53 };
54
55 /************************************************************************
56 ***********************************************************************/
57
58 static ADS_STATUS ad_idmap_cached_connection(struct idmap_domain *dom)
59 {
60 ADS_STATUS status;
61 struct idmap_ad_context * ctx;
62
63 DEBUG(10, ("ad_idmap_cached_connection: called for domain '%s'\n",
64 dom->name));
65
66 ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
67
68 status = ads_idmap_cached_connection(&ctx->ads, dom->name);
69 if (!ADS_ERR_OK(status)) {
70 return status;
71 }
72
73 ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
74
75 /* if we have a valid ADS_STRUCT and the schema model is
76 defined, then we can return here. */
77
78 if ( ctx->ad_schema ) {
79 return ADS_SUCCESS;
80 }
81
82 /* Otherwise, set the schema model */
83
84 if ( (ctx->ad_map_type == WB_POSIX_MAP_SFU) ||
85 (ctx->ad_map_type == WB_POSIX_MAP_SFU20) ||
86 (ctx->ad_map_type == WB_POSIX_MAP_RFC2307) )
87 {
88 status = ads_check_posix_schema_mapping(
89 ctx, ctx->ads, ctx->ad_map_type, &ctx->ad_schema);
90 if ( !ADS_ERR_OK(status) ) {
91 DEBUG(2,("ad_idmap_cached_connection: Failed to obtain schema details!\n"));
92 }
93 }
94
95 return status;
96 }
97
98 static int idmap_ad_context_destructor(struct idmap_ad_context *ctx)
99 {
100 if (ctx->ads != NULL) {
101 /* we own this ADS_STRUCT so make sure it goes away */
102 ctx->ads->is_mine = True;
103 ads_destroy( &ctx->ads );
104 ctx->ads = NULL;
105 }
106 return 0;
107 }
108
109 /************************************************************************
110 ***********************************************************************/
111
112 static NTSTATUS idmap_ad_initialize(struct idmap_domain *dom)
113 {
114 struct idmap_ad_context *ctx;
115 char *config_option;
116 const char *schema_mode = NULL;
117
118 ctx = talloc_zero(dom, struct idmap_ad_context);
119 if (ctx == NULL) {
120 DEBUG(0, ("Out of memory!\n"));
121 return NT_STATUS_NO_MEMORY;
122 }
123 talloc_set_destructor(ctx, idmap_ad_context_destructor);
124
125 config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
126 if (config_option == NULL) {
127 DEBUG(0, ("Out of memory!\n"));
128 talloc_free(ctx);
129 return NT_STATUS_NO_MEMORY;
130 }
131
132 /* default map type */
133 ctx->ad_map_type = WB_POSIX_MAP_RFC2307;
134
135 /* schema mode */
136 schema_mode = lp_parm_const_string(-1, config_option, "schema_mode", NULL);
137 if ( schema_mode && schema_mode[0] ) {
138 if ( strequal(schema_mode, "sfu") )
139 ctx->ad_map_type = WB_POSIX_MAP_SFU;
140 else if ( strequal(schema_mode, "sfu20" ) )
141 ctx->ad_map_type = WB_POSIX_MAP_SFU20;
142 else if ( strequal(schema_mode, "rfc2307" ) )
143 ctx->ad_map_type = WB_POSIX_MAP_RFC2307;
144 else
145 DEBUG(0,("idmap_ad_initialize: Unknown schema_mode (%s)\n",
146 schema_mode));
147 }
148
149 dom->private_data = ctx;
150
151 talloc_free(config_option);
152
153 return NT_STATUS_OK;
154 }
155
156 /************************************************************************
157 ***********************************************************************/
158
159 static NTSTATUS idmap_ad_unixids_to_sids(struct idmap_domain *dom, struct id_map **ids)
160 {
161 NTSTATUS ret;
162 TALLOC_CTX *memctx;
163 struct idmap_ad_context *ctx;
164 ADS_STATUS rc;
165 const char *attrs[] = { "sAMAccountType",
166 "objectSid",
167 NULL, /* uidnumber */
168 NULL, /* gidnumber */
169 NULL };
170 LDAPMessage *res = NULL;
171 LDAPMessage *entry = NULL;
172 char *filter = NULL;
173 int idx = 0;
174 int bidx = 0;
175 int count;
176 int i;
177 char *u_filter = NULL;
178 char *g_filter = NULL;
179
180 /* initialize the status to avoid suprise */
181 for (i = 0; ids[i]; i++) {
182 ids[i]->status = ID_UNKNOWN;
183 }
184
185 /* Only do query if we are online */
186 if (idmap_is_offline()) {
187 return NT_STATUS_FILE_IS_OFFLINE;
188 }
189
190 ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
191
192 if ( (memctx = talloc_new(ctx)) == NULL ) {
193 DEBUG(0, ("Out of memory!\n"));
194 return NT_STATUS_NO_MEMORY;
195 }
196
197 rc = ad_idmap_cached_connection(dom);
198 if (!ADS_ERR_OK(rc)) {
199 DEBUG(1, ("ADS uninitialized: %s\n", ads_errstr(rc)));
200 ret = NT_STATUS_UNSUCCESSFUL;
201 /* ret = ads_ntstatus(rc); */
202 goto done;
203 }
204
205 attrs[2] = ctx->ad_schema->posix_uidnumber_attr;
206 attrs[3] = ctx->ad_schema->posix_gidnumber_attr;
207
208 again:
209 bidx = idx;
210 for (i = 0; (i < IDMAP_LDAP_MAX_IDS) && ids[idx]; i++, idx++) {
211 switch (ids[idx]->xid.type) {
212 case ID_TYPE_UID:
213 if ( ! u_filter) {
214 u_filter = talloc_asprintf(memctx, "(&(|"
215 "(sAMAccountType=%d)"
216 "(sAMAccountType=%d)"
217 "(sAMAccountType=%d))(|",
218 ATYPE_NORMAL_ACCOUNT,
219 ATYPE_WORKSTATION_TRUST,
220 ATYPE_INTERDOMAIN_TRUST);
221 }
222 u_filter = talloc_asprintf_append_buffer(u_filter, "(%s=%lu)",
223 ctx->ad_schema->posix_uidnumber_attr,
224 (unsigned long)ids[idx]->xid.id);
225 CHECK_ALLOC_DONE(u_filter);
226 break;
227
228 case ID_TYPE_GID:
229 if ( ! g_filter) {
230 g_filter = talloc_asprintf(memctx, "(&(|"
231 "(sAMAccountType=%d)"
232 "(sAMAccountType=%d))(|",
233 ATYPE_SECURITY_GLOBAL_GROUP,
234 ATYPE_SECURITY_LOCAL_GROUP);
235 }
236 g_filter = talloc_asprintf_append_buffer(g_filter, "(%s=%lu)",
237 ctx->ad_schema->posix_gidnumber_attr,
238 (unsigned long)ids[idx]->xid.id);
239 CHECK_ALLOC_DONE(g_filter);
240 break;
241
242 default:
243 DEBUG(3, ("Error: mapping requested but Unknown ID type\n"));
244 ids[idx]->status = ID_UNKNOWN;
245 continue;
246 }
247 }
248 filter = talloc_asprintf(memctx, "(|");
249 CHECK_ALLOC_DONE(filter);
250 if ( u_filter) {
251 filter = talloc_asprintf_append_buffer(filter, "%s))", u_filter);
252 CHECK_ALLOC_DONE(filter);
253 TALLOC_FREE(u_filter);
254 }
255 if ( g_filter) {
256 filter = talloc_asprintf_append_buffer(filter, "%s))", g_filter);
257 CHECK_ALLOC_DONE(filter);
258 TALLOC_FREE(g_filter);
259 }
260 filter = talloc_asprintf_append_buffer(filter, ")");
261 CHECK_ALLOC_DONE(filter);
262
263 rc = ads_search_retry(ctx->ads, &res, filter, attrs);
264 if (!ADS_ERR_OK(rc)) {
265 DEBUG(1, ("ERROR: ads search returned: %s\n", ads_errstr(rc)));
266 ret = NT_STATUS_UNSUCCESSFUL;
267 goto done;
268 }
269
270 if ( (count = ads_count_replies(ctx->ads, res)) == 0 ) {
271 DEBUG(10, ("No IDs found\n"));
272 }
273
274 entry = res;
275 for (i = 0; (i < count) && entry; i++) {
276 struct dom_sid sid;
277 enum id_type type;
278 struct id_map *map;
279 uint32_t id;
280 uint32_t atype;
281
282 if (i == 0) { /* first entry */
283 entry = ads_first_entry(ctx->ads, entry);
284 } else { /* following ones */
285 entry = ads_next_entry(ctx->ads, entry);
286 }
287
288 if ( !entry ) {
289 DEBUG(2, ("ERROR: Unable to fetch ldap entries from results\n"));
290 break;
291 }
292
293 /* first check if the SID is present */
294 if (!ads_pull_sid(ctx->ads, entry, "objectSid", &sid)) {
295 DEBUG(2, ("Could not retrieve SID from entry\n"));
296 continue;
297 }
298
299 /* get type */
300 if (!ads_pull_uint32(ctx->ads, entry, "sAMAccountType", &atype)) {
301 DEBUG(1, ("could not get SAM account type\n"));
302 continue;
303 }
304
305 switch (atype & 0xF0000000) {
306 case ATYPE_SECURITY_GLOBAL_GROUP:
307 case ATYPE_SECURITY_LOCAL_GROUP:
308 type = ID_TYPE_GID;
309 break;
310 case ATYPE_NORMAL_ACCOUNT:
311 case ATYPE_WORKSTATION_TRUST:
312 case ATYPE_INTERDOMAIN_TRUST:
313 type = ID_TYPE_UID;
314 break;
315 default:
316 DEBUG(1, ("unrecognized SAM account type %08x\n", atype));
317 continue;
318 }
319
320 if (!ads_pull_uint32(ctx->ads, entry, (type==ID_TYPE_UID) ?
321 ctx->ad_schema->posix_uidnumber_attr :
322 ctx->ad_schema->posix_gidnumber_attr,
323 &id))
324 {
325 DEBUG(1, ("Could not get unix ID for SID %s\n",
326 dom_sid_string(talloc_tos(), &sid)));
327 continue;
328 }
329
330 if (!idmap_unix_id_is_in_range(id, dom)) {
331 DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
332 id, dom->low_id, dom->high_id));
333 continue;
334 }
335
336 map = idmap_find_map_by_id(&ids[bidx], type, id);
337 if (!map) {
338 DEBUG(2, ("WARNING: couldn't match result with requested ID\n"));
339 continue;
340 }
341
342 sid_copy(map->sid, &sid);
343
344 /* mapped */
345 map->status = ID_MAPPED;
346
347 DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
348 (unsigned long)map->xid.id,
349 map->xid.type));
350 }
351
352 if (res) {
353 ads_msgfree(ctx->ads, res);
354 }
355
356 if (ids[idx]) { /* still some values to map */
357 goto again;
358 }
359
360 ret = NT_STATUS_OK;
361
362 /* mark all unknown/expired ones as unmapped */
363 for (i = 0; ids[i]; i++) {
364 if (ids[i]->status != ID_MAPPED)
365 ids[i]->status = ID_UNMAPPED;
366 }
367
368 done:
369 talloc_free(memctx);
370 return ret;
371 }
372
373 /************************************************************************
374 ***********************************************************************/
375
376 static NTSTATUS idmap_ad_sids_to_unixids(struct idmap_domain *dom, struct id_map **ids)
377 {
378 NTSTATUS ret;
379 TALLOC_CTX *memctx;
380 struct idmap_ad_context *ctx;
381 ADS_STATUS rc;
382 const char *attrs[] = { "sAMAccountType",
383 "objectSid",
384 NULL, /* attr_uidnumber */
385 NULL, /* attr_gidnumber */
386 NULL };
387 LDAPMessage *res = NULL;
388 LDAPMessage *entry = NULL;
389 char *filter = NULL;
390 int idx = 0;
391 int bidx = 0;
392 int count;
393 int i;
394 char *sidstr;
395
396 /* initialize the status to avoid suprise */
397 for (i = 0; ids[i]; i++) {
398 ids[i]->status = ID_UNKNOWN;
399 }
400
401 /* Only do query if we are online */
402 if (idmap_is_offline()) {
403 return NT_STATUS_FILE_IS_OFFLINE;
404 }
405
406 ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
407
408 if ( (memctx = talloc_new(ctx)) == NULL ) {
409 DEBUG(0, ("Out of memory!\n"));
410 return NT_STATUS_NO_MEMORY;
411 }
412
413 rc = ad_idmap_cached_connection(dom);
414 if (!ADS_ERR_OK(rc)) {
415 DEBUG(1, ("ADS uninitialized: %s\n", ads_errstr(rc)));
416 ret = NT_STATUS_UNSUCCESSFUL;
417 /* ret = ads_ntstatus(rc); */
418 goto done;
419 }
420
421 if (ctx->ad_schema == NULL) {
422 DEBUG(0, ("haven't got ctx->ad_schema ! \n"));
423 ret = NT_STATUS_UNSUCCESSFUL;
424 goto done;
425 }
426
427 attrs[2] = ctx->ad_schema->posix_uidnumber_attr;
428 attrs[3] = ctx->ad_schema->posix_gidnumber_attr;
429
430 again:
431 filter = talloc_asprintf(memctx, "(&(|"
432 "(sAMAccountType=%d)(sAMAccountType=%d)(sAMAccountType=%d)" /* user account types */
433 "(sAMAccountType=%d)(sAMAccountType=%d)" /* group account types */
434 ")(|",
435 ATYPE_NORMAL_ACCOUNT, ATYPE_WORKSTATION_TRUST, ATYPE_INTERDOMAIN_TRUST,
436 ATYPE_SECURITY_GLOBAL_GROUP, ATYPE_SECURITY_LOCAL_GROUP);
437
438 CHECK_ALLOC_DONE(filter);
439
440 bidx = idx;
441 for (i = 0; (i < IDMAP_LDAP_MAX_IDS) && ids[idx]; i++, idx++) {
442
443 ids[idx]->status = ID_UNKNOWN;
444
445 sidstr = ldap_encode_ndr_dom_sid(talloc_tos(), ids[idx]->sid);
446 filter = talloc_asprintf_append_buffer(filter, "(objectSid=%s)", sidstr);
447
448 TALLOC_FREE(sidstr);
449 CHECK_ALLOC_DONE(filter);
450 }
451 filter = talloc_asprintf_append_buffer(filter, "))");
452 CHECK_ALLOC_DONE(filter);
453 DEBUG(10, ("Filter: [%s]\n", filter));
454
455 rc = ads_search_retry(ctx->ads, &res, filter, attrs);
456 if (!ADS_ERR_OK(rc)) {
457 DEBUG(1, ("ERROR: ads search returned: %s\n", ads_errstr(rc)));
458 ret = NT_STATUS_UNSUCCESSFUL;
459 goto done;
460 }
461
462 if ( (count = ads_count_replies(ctx->ads, res)) == 0 ) {
463 DEBUG(10, ("No IDs found\n"));
464 }
465
466 entry = res;
467 for (i = 0; (i < count) && entry; i++) {
468 struct dom_sid sid;
469 enum id_type type;
470 struct id_map *map;
471 uint32_t id;
472 uint32_t atype;
473
474 if (i == 0) { /* first entry */
475 entry = ads_first_entry(ctx->ads, entry);
476 } else { /* following ones */
477 entry = ads_next_entry(ctx->ads, entry);
478 }
479
480 if ( !entry ) {
481 DEBUG(2, ("ERROR: Unable to fetch ldap entries from results\n"));
482 break;
483 }
484
485 /* first check if the SID is present */
486 if (!ads_pull_sid(ctx->ads, entry, "objectSid", &sid)) {
487 DEBUG(2, ("Could not retrieve SID from entry\n"));
488 continue;
489 }
490
491 map = idmap_find_map_by_sid(&ids[bidx], &sid);
492 if (!map) {
493 DEBUG(2, ("WARNING: couldn't match result with requested SID\n"));
494 continue;
495 }
496
497 /* get type */
498 if (!ads_pull_uint32(ctx->ads, entry, "sAMAccountType", &atype)) {
499 DEBUG(1, ("could not get SAM account type\n"));
500 continue;
501 }
502
503 switch (atype & 0xF0000000) {
504 case ATYPE_SECURITY_GLOBAL_GROUP:
505 case ATYPE_SECURITY_LOCAL_GROUP:
506 type = ID_TYPE_GID;
507 break;
508 case ATYPE_NORMAL_ACCOUNT:
509 case ATYPE_WORKSTATION_TRUST:
510 case ATYPE_INTERDOMAIN_TRUST:
511 type = ID_TYPE_UID;
512 break;
513 default:
514 DEBUG(1, ("unrecognized SAM account type %08x\n", atype));
515 continue;
516 }
517
518 if (!ads_pull_uint32(ctx->ads, entry, (type==ID_TYPE_UID) ?
519 ctx->ad_schema->posix_uidnumber_attr :
520 ctx->ad_schema->posix_gidnumber_attr,
521 &id))
522 {
523 DEBUG(1, ("Could not get unix ID for SID %s\n",
524 sid_string_dbg(map->sid)));
525 continue;
526 }
527 if (!idmap_unix_id_is_in_range(id, dom)) {
528 DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
529 id, dom->low_id, dom->high_id));
530 continue;
531 }
532
533 /* mapped */
534 map->xid.type = type;
535 map->xid.id = id;
536 map->status = ID_MAPPED;
537
538 DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
539 (unsigned long)map->xid.id,
540 map->xid.type));
541 }
542
543 if (res) {
544 ads_msgfree(ctx->ads, res);
545 }
546
547 if (ids[idx]) { /* still some values to map */
548 goto again;
549 }
550
551 ret = NT_STATUS_OK;
552
553 /* mark all unknown/expired ones as unmapped */
554 for (i = 0; ids[i]; i++) {
555 if (ids[i]->status != ID_MAPPED)
556 ids[i]->status = ID_UNMAPPED;
557 }
558
559 done:
560 talloc_free(memctx);
561 return ret;
562 }
563
564 /*
565 * nss_info_{sfu,sfu20,rfc2307}
566 */
567
568 /************************************************************************
569 Initialize the {sfu,sfu20,rfc2307} state
570 ***********************************************************************/
571
572 static const char *wb_posix_map_unknown_string = "WB_POSIX_MAP_UNKNOWN";
573 static const char *wb_posix_map_template_string = "WB_POSIX_MAP_TEMPLATE";
574 static const char *wb_posix_map_sfu_string = "WB_POSIX_MAP_SFU";
575 static const char *wb_posix_map_sfu20_string = "WB_POSIX_MAP_SFU20";
576 static const char *wb_posix_map_rfc2307_string = "WB_POSIX_MAP_RFC2307";
577 static const char *wb_posix_map_unixinfo_string = "WB_POSIX_MAP_UNIXINFO";
578
579 static const char *ad_map_type_string(enum wb_posix_mapping map_type)
580 {
581 switch (map_type) {
582 case WB_POSIX_MAP_TEMPLATE:
583 return wb_posix_map_template_string;
584 case WB_POSIX_MAP_SFU:
585 return wb_posix_map_sfu_string;
586 case WB_POSIX_MAP_SFU20:
587 return wb_posix_map_sfu20_string;
588 case WB_POSIX_MAP_RFC2307:
589 return wb_posix_map_rfc2307_string;
590 case WB_POSIX_MAP_UNIXINFO:
591 return wb_posix_map_unixinfo_string;
592 default:
593 return wb_posix_map_unknown_string;
594 }
595 }
596
597 static NTSTATUS nss_ad_generic_init(struct nss_domain_entry *e,
598 enum wb_posix_mapping new_ad_map_type)
599 {
600 struct idmap_domain *dom;
601 struct idmap_ad_context *ctx;
602
603 if (e->state != NULL) {
604 dom = talloc_get_type(e->state, struct idmap_domain);
605 } else {
606 dom = talloc_zero(e, struct idmap_domain);
607 if (dom == NULL) {
608 DEBUG(0, ("Out of memory!\n"));
609 return NT_STATUS_NO_MEMORY;
610 }
611 e->state = dom;
612 }
613
614 if (e->domain != NULL) {
615 dom->name = talloc_strdup(dom, e->domain);
616 if (dom->name == NULL) {
617 DEBUG(0, ("Out of memory!\n"));
618 return NT_STATUS_NO_MEMORY;
619 }
620 }
621
622 if (dom->private_data != NULL) {
623 ctx = talloc_get_type(dom->private_data,
624 struct idmap_ad_context);
625 } else {
626 ctx = talloc_zero(dom, struct idmap_ad_context);
627 if (ctx == NULL) {
628 DEBUG(0, ("Out of memory!\n"));
629 return NT_STATUS_NO_MEMORY;
630 }
631 ctx->ad_map_type = WB_POSIX_MAP_RFC2307;
632 dom->private_data = ctx;
633 }
634
635 if ((ctx->ad_map_type != WB_POSIX_MAP_UNKNOWN) &&
636 (ctx->ad_map_type != new_ad_map_type))
637 {
638 DEBUG(2, ("nss_ad_generic_init: "
639 "Warning: overriding previously set posix map type "
640 "%s for domain %s with map type %s.\n",
641 ad_map_type_string(ctx->ad_map_type),
642 dom->name,
643 ad_map_type_string(new_ad_map_type)));
644 }
645
646 ctx->ad_map_type = new_ad_map_type;
647
648 return NT_STATUS_OK;
649 }
650
651 static NTSTATUS nss_sfu_init( struct nss_domain_entry *e )
652 {
653 return nss_ad_generic_init(e, WB_POSIX_MAP_SFU);
654 }
655
656 static NTSTATUS nss_sfu20_init( struct nss_domain_entry *e )
657 {
658 return nss_ad_generic_init(e, WB_POSIX_MAP_SFU20);
659 }
660
661 static NTSTATUS nss_rfc2307_init( struct nss_domain_entry *e )
662 {
663 return nss_ad_generic_init(e, WB_POSIX_MAP_RFC2307);
664 }
665
666
667 /************************************************************************
668 ***********************************************************************/
669
670 static NTSTATUS nss_ad_get_info( struct nss_domain_entry *e,
671 const struct dom_sid *sid,
672 TALLOC_CTX *mem_ctx,
673 const char **homedir,
674 const char **shell,
675 const char **gecos,
676 gid_t *p_gid )
677 {
678 const char *attrs[] = {NULL, /* attr_homedir */
679 NULL, /* attr_shell */
680 NULL, /* attr_gecos */
681 NULL, /* attr_gidnumber */
682 NULL };
683 char *filter = NULL;
684 LDAPMessage *msg_internal = NULL;
685 ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
686 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
687 char *sidstr = NULL;
688 struct idmap_domain *dom;
689 struct idmap_ad_context *ctx;
690
691 DEBUG(10, ("nss_ad_get_info called for sid [%s] in domain '%s'\n",
692 sid_string_dbg(sid), e->domain?e->domain:"NULL"));
693
694 /* Only do query if we are online */
695 if (idmap_is_offline()) {
696 return NT_STATUS_FILE_IS_OFFLINE;
697 }
698
699 dom = talloc_get_type(e->state, struct idmap_domain);
700 ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
701
702 ads_status = ad_idmap_cached_connection(dom);
703 if (!ADS_ERR_OK(ads_status)) {
704 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
705 }
706
707 if (!ctx->ad_schema) {
708 DEBUG(10, ("nss_ad_get_info: no ad_schema configured!\n"));
709 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
710 }
711
712 if (!sid || !homedir || !shell || !gecos) {
713 return NT_STATUS_INVALID_PARAMETER;
714 }
715
716 /* Have to do our own query */
717
718 DEBUG(10, ("nss_ad_get_info: no ads connection given, doing our "
719 "own query\n"));
720
721 attrs[0] = ctx->ad_schema->posix_homedir_attr;
722 attrs[1] = ctx->ad_schema->posix_shell_attr;
723 attrs[2] = ctx->ad_schema->posix_gecos_attr;
724 attrs[3] = ctx->ad_schema->posix_gidnumber_attr;
725
726 sidstr = ldap_encode_ndr_dom_sid(mem_ctx, sid);
727 filter = talloc_asprintf(mem_ctx, "(objectSid=%s)", sidstr);
728 TALLOC_FREE(sidstr);
729
730 if (!filter) {
731 nt_status = NT_STATUS_NO_MEMORY;
732 goto done;
733 }
734
735 ads_status = ads_search_retry(ctx->ads, &msg_internal, filter, attrs);
736 if (!ADS_ERR_OK(ads_status)) {
737 nt_status = ads_ntstatus(ads_status);
738 goto done;
739 }
740
741 *homedir = ads_pull_string(ctx->ads, mem_ctx, msg_internal, ctx->ad_schema->posix_homedir_attr);
742 *shell = ads_pull_string(ctx->ads, mem_ctx, msg_internal, ctx->ad_schema->posix_shell_attr);
743 *gecos = ads_pull_string(ctx->ads, mem_ctx, msg_internal, ctx->ad_schema->posix_gecos_attr);
744
745 if (p_gid != NULL) {
746 uint32_t gid = UINT32_MAX;
747 bool ok;
748
749 ok = ads_pull_uint32(ctx->ads, msg_internal,
750 ctx->ad_schema->posix_gidnumber_attr,
751 &gid);
752 if (ok) {
753 *p_gid = gid;
754 } else {
755 *p_gid = (gid_t)-1;
756 }
757 }
758
759 nt_status = NT_STATUS_OK;
760
761 done:
762 if (msg_internal) {
763 ads_msgfree(ctx->ads, msg_internal);
764 }
765
766 return nt_status;
767 }
768
769 /**********************************************************************
770 *********************************************************************/
771
772 static NTSTATUS nss_ad_map_to_alias(TALLOC_CTX *mem_ctx,
773 struct nss_domain_entry *e,
774 const char *name,
775 char **alias)
776 {
777 const char *attrs[] = {NULL, /* attr_uid */
778 NULL };
779 char *filter = NULL;
780 LDAPMessage *msg = NULL;
781 ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
782 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
783 struct idmap_domain *dom;
784 struct idmap_ad_context *ctx = NULL;
785
786 /* Check incoming parameters */
787
788 if ( !e || !e->domain || !name || !*alias) {
789 nt_status = NT_STATUS_INVALID_PARAMETER;
790 goto done;
791 }
792
793 /* Only do query if we are online */
794
795 if (idmap_is_offline()) {
796 nt_status = NT_STATUS_FILE_IS_OFFLINE;
797 goto done;
798 }
799
800 dom = talloc_get_type(e->state, struct idmap_domain);
801 ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
802
803 ads_status = ad_idmap_cached_connection(dom);
804 if (!ADS_ERR_OK(ads_status)) {
805 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
806 }
807
808 if (!ctx->ad_schema) {
809 nt_status = NT_STATUS_OBJECT_PATH_NOT_FOUND;
810 goto done;
811 }
812
813 attrs[0] = ctx->ad_schema->posix_uid_attr;
814
815 filter = talloc_asprintf(mem_ctx,
816 "(sAMAccountName=%s)",
817 name);
818 if (!filter) {
819 nt_status = NT_STATUS_NO_MEMORY;
820 goto done;
821 }
822
823 ads_status = ads_search_retry(ctx->ads, &msg, filter, attrs);
824 if (!ADS_ERR_OK(ads_status)) {
825 nt_status = ads_ntstatus(ads_status);
826 goto done;
827 }
828
829 *alias = ads_pull_string(ctx->ads, mem_ctx, msg, ctx->ad_schema->posix_uid_attr);
830
831 if (!*alias) {
832 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
833 }
834
835 nt_status = NT_STATUS_OK;
836
837 done:
838 if (filter) {
839 talloc_destroy(filter);
840 }
841 if (msg) {
842 ads_msgfree(ctx->ads, msg);
843 }
844
845 return nt_status;
846 }
847
848 /**********************************************************************
849 *********************************************************************/
850
851 static NTSTATUS nss_ad_map_from_alias( TALLOC_CTX *mem_ctx,
852 struct nss_domain_entry *e,
853 const char *alias,
854 char **name )
855 {
856 const char *attrs[] = {"sAMAccountName",
857 NULL };
858 char *filter = NULL;
859 LDAPMessage *msg = NULL;
860 ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
861 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
862 char *username;
863 struct idmap_domain *dom;
864 struct idmap_ad_context *ctx = NULL;
865
866 /* Check incoming parameters */
867
868 if ( !alias || !name) {
869 nt_status = NT_STATUS_INVALID_PARAMETER;
870 goto done;
871 }
872
873 /* Only do query if we are online */
874
875 if (idmap_is_offline()) {
876 nt_status = NT_STATUS_FILE_IS_OFFLINE;
877 goto done;
878 }
879
880 dom = talloc_get_type(e->state, struct idmap_domain);
881 ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
882
883 ads_status = ad_idmap_cached_connection(dom);
884 if (!ADS_ERR_OK(ads_status)) {
885 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
886 }
887
888 if (!ctx->ad_schema) {
889 nt_status = NT_STATUS_OBJECT_PATH_NOT_FOUND;
890 goto done;
891 }
892
893 filter = talloc_asprintf(mem_ctx,
894 "(%s=%s)",
895 ctx->ad_schema->posix_uid_attr,
896 alias);
897 if (!filter) {
898 nt_status = NT_STATUS_NO_MEMORY;
899 goto done;
900 }
901
902 ads_status = ads_search_retry(ctx->ads, &msg, filter, attrs);
903 if (!ADS_ERR_OK(ads_status)) {
904 nt_status = ads_ntstatus(ads_status);
905 goto done;
906 }
907
908 username = ads_pull_string(ctx->ads, mem_ctx, msg,
909 "sAMAccountName");
910 if (!username) {
911 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
912 }
913
914 *name = talloc_asprintf(mem_ctx, "%s\\%s",
915 lp_workgroup(),
916 username);
917 if (!*name) {
918 nt_status = NT_STATUS_NO_MEMORY;
919 goto done;
920 }
921
922 nt_status = NT_STATUS_OK;
923
924 done:
925 if (filter) {
926 talloc_destroy(filter);
927 }
928 if (msg) {
929 ads_msgfree(ctx->ads, msg);
930 }
931
932 return nt_status;
933 }
934
935 /************************************************************************
936 Function dispatch tables for the idmap and nss plugins
937 ***********************************************************************/
938
939 static struct idmap_methods ad_methods = {
940 .init = idmap_ad_initialize,
941 .unixids_to_sids = idmap_ad_unixids_to_sids,
942 .sids_to_unixids = idmap_ad_sids_to_unixids,
943 };
944
945 /* The SFU and RFC2307 NSS plugins share everything but the init
946 function which sets the intended schema model to use */
947
948 static struct nss_info_methods nss_rfc2307_methods = {
949 .init = nss_rfc2307_init,
950 .get_nss_info = nss_ad_get_info,
951 .map_to_alias = nss_ad_map_to_alias,
952 .map_from_alias = nss_ad_map_from_alias,
953 };
954
955 static struct nss_info_methods nss_sfu_methods = {
956 .init = nss_sfu_init,
957 .get_nss_info = nss_ad_get_info,
958 .map_to_alias = nss_ad_map_to_alias,
959 .map_from_alias = nss_ad_map_from_alias,
960 };
961
962 static struct nss_info_methods nss_sfu20_methods = {
963 .init = nss_sfu20_init,
964 .get_nss_info = nss_ad_get_info,
965 .map_to_alias = nss_ad_map_to_alias,
966 .map_from_alias = nss_ad_map_from_alias,
967 };
968
969
970
971 /************************************************************************
972 Initialize the plugins
973 ***********************************************************************/
974
975 static_decl_idmap;
976 NTSTATUS idmap_ad_init(void)
977 {
978 static NTSTATUS status_idmap_ad = NT_STATUS_UNSUCCESSFUL;
979 static NTSTATUS status_nss_rfc2307 = NT_STATUS_UNSUCCESSFUL;
980 static NTSTATUS status_nss_sfu = NT_STATUS_UNSUCCESSFUL;
981 static NTSTATUS status_nss_sfu20 = NT_STATUS_UNSUCCESSFUL;
982
983 /* Always register the AD method first in order to get the
984 idmap_domain interface called */
985
986 if ( !NT_STATUS_IS_OK(status_idmap_ad) ) {
987 status_idmap_ad = smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION,
988 "ad", &ad_methods);
989 if ( !NT_STATUS_IS_OK(status_idmap_ad) )
990 return status_idmap_ad;
991 }
992
993 if ( !NT_STATUS_IS_OK( status_nss_rfc2307 ) ) {
994 status_nss_rfc2307 = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
995 "rfc2307", &nss_rfc2307_methods );
996 if ( !NT_STATUS_IS_OK(status_nss_rfc2307) )
997 return status_nss_rfc2307;
998 }
999
1000 if ( !NT_STATUS_IS_OK( status_nss_sfu ) ) {
1001 status_nss_sfu = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
1002 "sfu", &nss_sfu_methods );
1003 if ( !NT_STATUS_IS_OK(status_nss_sfu) )
1004 return status_nss_sfu;
1005 }
1006
1007 if ( !NT_STATUS_IS_OK( status_nss_sfu20 ) ) {
1008 status_nss_sfu20 = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
1009 "sfu20", &nss_sfu20_methods );
1010 if ( !NT_STATUS_IS_OK(status_nss_sfu20) )
1011 return status_nss_sfu20;
1012 }
1013
1014 return NT_STATUS_OK;
1015 }
1016
Samba GIT mirror