2 Unix SMB/CIFS implementation.
4 Winbind daemon - user related functions
6 Copyright (C) Tim Potter 2000
7 Copyright (C) Jeremy Allison 2001.
8 Copyright (C) Gerald (Jerry) Carter 2003.
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
29 #define DBGC_CLASS DBGC_WINBIND
31 extern userdom_struct current_user_info
;
33 /* Fill a pwent structure with information we have obtained */
35 static BOOL
winbindd_fill_pwent(char *dom_name
, char *user_name
,
36 DOM_SID
*user_sid
, DOM_SID
*group_sid
,
37 char *full_name
, struct winbindd_pw
*pw
)
39 fstring output_username
;
44 if (!pw
|| !dom_name
|| !user_name
)
47 /* Resolve the uid number */
49 if (!NT_STATUS_IS_OK(idmap_sid_to_uid(user_sid
, &pw
->pw_uid
, 0))) {
50 DEBUG(1, ("error getting user id for sid %s\n", sid_to_string(sid_string
, user_sid
)));
54 /* Resolve the gid number */
56 if (!NT_STATUS_IS_OK(idmap_sid_to_gid(group_sid
, &pw
->pw_gid
, 0))) {
57 DEBUG(1, ("error getting group id for sid %s\n", sid_to_string(sid_string
, group_sid
)));
61 strlower_m(user_name
);
65 fill_domain_username(output_username
, dom_name
, user_name
);
67 safe_strcpy(pw
->pw_name
, output_username
, sizeof(pw
->pw_name
) - 1);
69 /* Full name (gecos) */
71 safe_strcpy(pw
->pw_gecos
, full_name
, sizeof(pw
->pw_gecos
) - 1);
73 /* Home directory and shell - use template config parameters. The
74 defaults are /tmp for the home directory and /bin/false for
77 /* The substitution of %U and %D in the 'template homedir' is done
78 by alloc_sub_specified() below. */
80 fstrcpy(current_user_info
.domain
, dom_name
);
82 homedir
= alloc_sub_specified(lp_template_homedir(), user_name
, dom_name
, pw
->pw_uid
, pw
->pw_gid
);
87 safe_strcpy(pw
->pw_dir
, homedir
, sizeof(pw
->pw_dir
) - 1);
91 shell
= alloc_sub_specified(lp_template_shell(), user_name
, dom_name
, pw
->pw_uid
, pw
->pw_gid
);
96 safe_strcpy(pw
->pw_shell
, shell
,
97 sizeof(pw
->pw_shell
) - 1);
101 /* Password - set to "x" as we can't generate anything useful here.
102 Authentication can be done using the pam_winbind module. */
104 safe_strcpy(pw
->pw_passwd
, "x", sizeof(pw
->pw_passwd
) - 1);
109 /* Return a password structure from a username. */
111 enum winbindd_result
winbindd_getpwnam(struct winbindd_cli_state
*state
)
113 WINBIND_USERINFO user_info
;
117 fstring name_domain
, name_user
;
118 enum SID_NAME_USE name_type
;
119 struct winbindd_domain
*domain
;
122 /* Ensure null termination */
123 state
->request
.data
.username
[sizeof(state
->request
.data
.username
)-1]='\0';
125 DEBUG(3, ("[%5lu]: getpwnam %s\n", (unsigned long)state
->pid
,
126 state
->request
.data
.username
));
128 /* Parse domain and username */
130 parse_domain_user(state
->request
.data
.username
,
131 name_domain
, name_user
);
133 /* if this is our local domain (or no domain), the do a local tdb search */
135 if ( !*name_domain
|| strequal(name_domain
, get_global_sam_name()) ) {
136 if ( !(pw
= wb_getpwnam(name_user
)) ) {
137 DEBUG(5,("winbindd_getpwnam: lookup for %s\\%s failed\n",
138 name_domain
, name_user
));
139 return WINBINDD_ERROR
;
141 memcpy( &state
->response
.data
.pw
, pw
, sizeof(WINBINDD_PW
) );
145 /* should we deal with users for our domain? */
147 if ((domain
= find_domain_from_name(name_domain
)) == NULL
) {
148 DEBUG(5, ("no such domain: %s\n", name_domain
));
149 return WINBINDD_ERROR
;
152 if ( domain
->primary
&& lp_winbind_trusted_domains_only()) {
153 DEBUG(7,("winbindd_getpwnam: My domain -- rejecting getpwnam() for %s\\%s.\n",
154 name_domain
, name_user
));
155 return WINBINDD_ERROR
;
158 /* Get rid and name type from name */
160 if (!winbindd_lookup_sid_by_name(domain
, domain
->name
, name_user
, &user_sid
, &name_type
)) {
161 DEBUG(1, ("user '%s' does not exist\n", name_user
));
162 return WINBINDD_ERROR
;
165 if (name_type
!= SID_NAME_USER
&& name_type
!= SID_NAME_COMPUTER
) {
166 DEBUG(1, ("name '%s' is not a user name: %d\n", name_user
,
168 return WINBINDD_ERROR
;
171 /* Get some user info. */
173 if (!(mem_ctx
= talloc_init("winbindd_getpwnam([%s]\\[%s])",
174 name_domain
, name_user
))) {
175 DEBUG(1, ("out of memory\n"));
176 return WINBINDD_ERROR
;
179 status
= domain
->methods
->query_user(domain
, mem_ctx
, &user_sid
,
182 if (!NT_STATUS_IS_OK(status
)) {
183 DEBUG(1, ("error getting user info for user '[%s]\\[%s]'\n",
184 name_domain
, name_user
));
185 talloc_destroy(mem_ctx
);
186 return WINBINDD_ERROR
;
189 /* Now take all this information and fill in a passwd structure */
190 if (!winbindd_fill_pwent(name_domain
, user_info
.acct_name
,
191 user_info
.user_sid
, user_info
.group_sid
,
193 &state
->response
.data
.pw
)) {
194 talloc_destroy(mem_ctx
);
195 return WINBINDD_ERROR
;
198 talloc_destroy(mem_ctx
);
203 /* Return a password structure given a uid number */
205 enum winbindd_result
winbindd_getpwuid(struct winbindd_cli_state
*state
)
208 struct winbindd_domain
*domain
;
212 enum SID_NAME_USE name_type
;
213 WINBIND_USERINFO user_info
;
218 /* Bug out if the uid isn't in the winbind range */
220 if ((state
->request
.data
.uid
< server_state
.uid_low
) ||
221 (state
->request
.data
.uid
> server_state
.uid_high
))
222 return WINBINDD_ERROR
;
224 DEBUG(3, ("[%5lu]: getpwuid %lu\n", (unsigned long)state
->pid
,
225 (unsigned long)state
->request
.data
.uid
));
227 /* always try local tdb first */
229 if ( (pw
= wb_getpwuid(state
->request
.data
.uid
)) != NULL
) {
230 memcpy( &state
->response
.data
.pw
, pw
, sizeof(WINBINDD_PW
) );
234 /* Get rid from uid */
236 if (!NT_STATUS_IS_OK(idmap_uid_to_sid(&user_sid
, state
->request
.data
.uid
))) {
237 DEBUG(1, ("could not convert uid %lu to SID\n",
238 (unsigned long)state
->request
.data
.uid
));
239 return WINBINDD_ERROR
;
242 /* Get name and name type from rid */
244 if (!winbindd_lookup_name_by_sid(&user_sid
, dom_name
, user_name
, &name_type
)) {
247 sid_to_string(temp
, &user_sid
);
248 DEBUG(1, ("could not lookup sid %s\n", temp
));
249 return WINBINDD_ERROR
;
252 domain
= find_domain_from_sid(&user_sid
);
255 DEBUG(1,("Can't find domain from sid\n"));
256 return WINBINDD_ERROR
;
259 /* Get some user info */
261 if (!(mem_ctx
= talloc_init("winbind_getpwuid(%lu)",
262 (unsigned long)state
->request
.data
.uid
))) {
264 DEBUG(1, ("out of memory\n"));
265 return WINBINDD_ERROR
;
268 status
= domain
->methods
->query_user(domain
, mem_ctx
, &user_sid
,
271 if (!NT_STATUS_IS_OK(status
)) {
272 DEBUG(1, ("error getting user info for user '%s'\n",
274 talloc_destroy(mem_ctx
);
275 return WINBINDD_ERROR
;
278 /* Check group has a gid number */
280 if (!NT_STATUS_IS_OK(idmap_sid_to_gid(user_info
.group_sid
, &gid
, 0))) {
281 DEBUG(1, ("error getting group id for user %s\n", user_name
));
282 talloc_destroy(mem_ctx
);
283 return WINBINDD_ERROR
;
286 /* Fill in password structure */
288 if (!winbindd_fill_pwent(domain
->name
, user_info
.acct_name
, user_info
.user_sid
,
290 user_info
.full_name
, &state
->response
.data
.pw
)) {
291 talloc_destroy(mem_ctx
);
292 return WINBINDD_ERROR
;
295 talloc_destroy(mem_ctx
);
301 * set/get/endpwent functions
304 /* Rewind file pointer for ntdom passwd database */
306 enum winbindd_result
winbindd_setpwent(struct winbindd_cli_state
*state
)
308 struct winbindd_domain
*domain
;
310 DEBUG(3, ("[%5lu]: setpwent\n", (unsigned long)state
->pid
));
312 /* Check user has enabled this */
314 if (!lp_winbind_enum_users())
315 return WINBINDD_ERROR
;
317 /* Free old static data if it exists */
319 if (state
->getpwent_state
!= NULL
) {
320 free_getent_state(state
->getpwent_state
);
321 state
->getpwent_state
= NULL
;
325 /* add any local users we have */
327 if ( (domain_state
= (struct getent_state
*)malloc(sizeof(struct getent_state
))) == NULL
)
328 return WINBINDD_ERROR
;
330 ZERO_STRUCTP(domain_state
);
332 /* Add to list of open domains */
334 DLIST_ADD(state
->getpwent_state
, domain_state
);
337 /* Create sam pipes for each domain we know about */
339 for(domain
= domain_list(); domain
!= NULL
; domain
= domain
->next
) {
340 struct getent_state
*domain_state
;
343 /* don't add our domaina if we are a PDC or if we
344 are a member of a Samba domain */
346 if ( (IS_DC
|| lp_winbind_trusted_domains_only())
347 && strequal(domain
->name
, lp_workgroup()) )
352 /* Create a state record for this domain */
354 if ((domain_state
= (struct getent_state
*)
355 malloc(sizeof(struct getent_state
))) == NULL
)
356 return WINBINDD_ERROR
;
358 ZERO_STRUCTP(domain_state
);
360 fstrcpy(domain_state
->domain_name
, domain
->name
);
362 /* Add to list of open domains */
364 DLIST_ADD(state
->getpwent_state
, domain_state
);
367 state
->getpwent_initialized
= True
;
372 /* Close file pointer to ntdom passwd database */
374 enum winbindd_result
winbindd_endpwent(struct winbindd_cli_state
*state
)
376 DEBUG(3, ("[%5lu]: endpwent\n", (unsigned long)state
->pid
));
378 free_getent_state(state
->getpwent_state
);
379 state
->getpwent_initialized
= False
;
380 state
->getpwent_state
= NULL
;
385 /* Get partial list of domain users for a domain. We fill in the sam_entries,
386 and num_sam_entries fields with domain user information. The dispinfo_ndx
387 field is incremented to the index of the next user to fetch. Return True if
388 some users were returned, False otherwise. */
390 static BOOL
get_sam_user_entries(struct getent_state
*ent
)
394 WINBIND_USERINFO
*info
;
395 struct getpwent_user
*name_list
= NULL
;
398 struct winbindd_domain
*domain
;
399 struct winbindd_methods
*methods
;
402 if (ent
->num_sam_entries
)
405 if (!(mem_ctx
= talloc_init("get_sam_user_entries(%s)",
409 if (!(domain
= find_domain_from_name(ent
->domain_name
))) {
410 DEBUG(3, ("no such domain %s in get_sam_user_entries\n",
415 methods
= domain
->methods
;
417 /* Free any existing user info */
419 SAFE_FREE(ent
->sam_entries
);
420 ent
->num_sam_entries
= 0;
422 /* Call query_user_list to get a list of usernames and user rids */
426 status
= methods
->query_user_list(domain
, mem_ctx
, &num_entries
,
430 struct getpwent_user
*tnl
;
432 tnl
= (struct getpwent_user
*)Realloc(name_list
,
433 sizeof(struct getpwent_user
) *
434 (ent
->num_sam_entries
+
438 DEBUG(0,("get_sam_user_entries realloc failed.\n"));
439 SAFE_FREE(name_list
);
445 for (i
= 0; i
< num_entries
; i
++) {
446 /* Store account name and gecos */
447 if (!info
[i
].acct_name
) {
448 fstrcpy(name_list
[ent
->num_sam_entries
+ i
].name
, "");
450 fstrcpy(name_list
[ent
->num_sam_entries
+ i
].name
,
453 if (!info
[i
].full_name
) {
454 fstrcpy(name_list
[ent
->num_sam_entries
+ i
].gecos
, "");
456 fstrcpy(name_list
[ent
->num_sam_entries
+ i
].gecos
,
460 /* User and group ids */
461 sid_copy(&name_list
[ent
->num_sam_entries
+i
].user_sid
, info
[i
].user_sid
);
462 sid_copy(&name_list
[ent
->num_sam_entries
+i
].group_sid
, info
[i
].group_sid
);
465 ent
->num_sam_entries
+= num_entries
;
467 /* Fill in remaining fields */
469 ent
->sam_entries
= name_list
;
470 ent
->sam_entry_index
= 0;
471 result
= ent
->num_sam_entries
> 0;
475 talloc_destroy(mem_ctx
);
480 /* Fetch next passwd entry from ntdom database */
482 #define MAX_GETPWENT_USERS 500
484 enum winbindd_result
winbindd_getpwent(struct winbindd_cli_state
*state
)
486 struct getent_state
*ent
;
487 struct winbindd_pw
*user_list
;
488 int num_users
, user_list_ndx
= 0, i
;
490 DEBUG(3, ("[%5lu]: getpwent\n", (unsigned long)state
->pid
));
492 /* Check user has enabled this */
494 if (!lp_winbind_enum_users())
495 return WINBINDD_ERROR
;
497 /* Allocate space for returning a chunk of users */
499 num_users
= MIN(MAX_GETPWENT_USERS
, state
->request
.data
.num_entries
);
501 if ((state
->response
.extra_data
=
502 malloc(num_users
* sizeof(struct winbindd_pw
))) == NULL
)
503 return WINBINDD_ERROR
;
505 memset(state
->response
.extra_data
, 0, num_users
*
506 sizeof(struct winbindd_pw
));
508 user_list
= (struct winbindd_pw
*)state
->response
.extra_data
;
510 if (!state
->getpwent_initialized
)
511 winbindd_setpwent(state
);
513 if (!(ent
= state
->getpwent_state
))
514 return WINBINDD_ERROR
;
516 /* Start sending back users */
518 for (i
= 0; i
< num_users
; i
++) {
519 struct getpwent_user
*name_list
= NULL
;
522 /* Do we need to fetch another chunk of users? */
524 if (ent
->num_sam_entries
== ent
->sam_entry_index
) {
526 while(ent
&& !get_sam_user_entries(ent
)) {
527 struct getent_state
*next_ent
;
529 /* Free state information for this domain */
531 SAFE_FREE(ent
->sam_entries
);
533 next_ent
= ent
->next
;
534 DLIST_REMOVE(state
->getpwent_state
, ent
);
540 /* No more domains */
546 name_list
= ent
->sam_entries
;
548 /* Lookup user info */
550 result
= winbindd_fill_pwent(
552 name_list
[ent
->sam_entry_index
].name
,
553 &name_list
[ent
->sam_entry_index
].user_sid
,
554 &name_list
[ent
->sam_entry_index
].group_sid
,
555 name_list
[ent
->sam_entry_index
].gecos
,
556 &user_list
[user_list_ndx
]);
558 ent
->sam_entry_index
++;
560 /* Add user to return list */
565 state
->response
.data
.num_entries
++;
566 state
->response
.length
+=
567 sizeof(struct winbindd_pw
);
570 DEBUG(1, ("could not lookup domain user %s\n",
571 name_list
[ent
->sam_entry_index
].name
));
576 return (user_list_ndx
> 0) ? WINBINDD_OK
: WINBINDD_ERROR
;
579 /* List domain users without mapping to unix ids */
581 enum winbindd_result
winbindd_list_users(struct winbindd_cli_state
*state
)
583 struct winbindd_domain
*domain
;
584 WINBIND_USERINFO
*info
;
585 const char *which_domain
;
586 uint32 num_entries
= 0, total_entries
= 0;
587 char *ted
, *extra_data
= NULL
;
588 int extra_data_len
= 0;
590 enum winbindd_result rv
= WINBINDD_ERROR
;
592 DEBUG(3, ("[%5lu]: list users\n", (unsigned long)state
->pid
));
594 if (!(mem_ctx
= talloc_init("winbindd_list_users")))
595 return WINBINDD_ERROR
;
597 /* Ensure null termination */
598 state
->request
.domain_name
[sizeof(state
->request
.domain_name
)-1]='\0';
599 which_domain
= state
->request
.domain_name
;
601 /* Enumerate over trusted domains */
603 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
605 struct winbindd_methods
*methods
;
608 /* if we have a domain name restricting the request and this
609 one in the list doesn't match, then just bypass the remainder
612 if ( *which_domain
&& !strequal(which_domain
, domain
->name
) )
615 methods
= domain
->methods
;
617 /* Query display info */
618 status
= methods
->query_user_list(domain
, mem_ctx
,
619 &num_entries
, &info
);
621 if (num_entries
== 0)
624 /* Allocate some memory for extra data */
625 total_entries
+= num_entries
;
627 ted
= Realloc(extra_data
, sizeof(fstring
) * total_entries
);
630 DEBUG(0,("failed to enlarge buffer!\n"));
631 SAFE_FREE(extra_data
);
636 /* Pack user list into extra data fields */
638 for (i
= 0; i
< num_entries
; i
++) {
639 fstring acct_name
, name
;
641 if (!info
[i
].acct_name
) {
642 fstrcpy(acct_name
, "");
644 fstrcpy(acct_name
, info
[i
].acct_name
);
647 fill_domain_username(name
, domain
->name
, acct_name
);
649 /* Append to extra data */
650 memcpy(&extra_data
[extra_data_len
], name
,
652 extra_data_len
+= strlen(name
);
653 extra_data
[extra_data_len
++] = ',';
657 /* Assign extra_data fields in response structure */
660 extra_data
[extra_data_len
- 1] = '\0';
661 state
->response
.extra_data
= extra_data
;
662 state
->response
.length
+= extra_data_len
;
665 /* No domains responded but that's still OK so don't return an
672 talloc_destroy(mem_ctx
);