2 * idmap_ad: map between Active Directory and RFC 2307 accounts
4 * Copyright (C) Volker Lendecke 2015
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
22 #include "libsmb/namequery.h"
24 #include "tldap_gensec_bind.h"
25 #include "tldap_util.h"
27 #include "lib/param/param.h"
28 #include "utils/net.h"
29 #include "auth/gensec/gensec.h"
30 #include "librpc/gen_ndr/ndr_netlogon.h"
31 #include "libads/ldap_schema_oids.h"
32 #include "../libds/common/flags.h"
33 #include "libcli/ldap/ldap_ndr.h"
34 #include "libcli/security/dom_sid.h"
36 struct idmap_ad_schema_names
;
38 struct idmap_ad_context
{
39 struct idmap_domain
*dom
;
40 struct tldap_context
*ld
;
41 struct idmap_ad_schema_names
*schema
;
42 const char *default_nc
;
44 bool unix_primary_group
;
48 static NTSTATUS
idmap_ad_get_context(struct idmap_domain
*dom
,
49 struct idmap_ad_context
**pctx
);
51 static char *get_schema_path(TALLOC_CTX
*mem_ctx
, struct tldap_context
*ld
)
53 struct tldap_message
*rootdse
;
55 rootdse
= tldap_rootdse(ld
);
56 if (rootdse
== NULL
) {
60 return tldap_talloc_single_attribute(rootdse
, "schemaNamingContext",
64 static char *get_default_nc(TALLOC_CTX
*mem_ctx
, struct tldap_context
*ld
)
66 struct tldap_message
*rootdse
;
68 rootdse
= tldap_rootdse(ld
);
69 if (rootdse
== NULL
) {
73 return tldap_talloc_single_attribute(rootdse
, "defaultNamingContext",
77 struct idmap_ad_schema_names
{
86 static TLDAPRC
get_attrnames_by_oids(struct tldap_context
*ld
,
88 const char *schema_path
,
94 const char *attrs
[] = { "lDAPDisplayName", "attributeId" };
97 struct tldap_message
**msgs
;
100 filter
= talloc_strdup(mem_ctx
, "(|");
101 if (filter
== NULL
) {
102 return TLDAP_NO_MEMORY
;
105 for (i
=0; i
<num_oids
; i
++) {
106 filter
= talloc_asprintf_append_buffer(
107 filter
, "(attributeId=%s)", oids
[i
]);
108 if (filter
== NULL
) {
109 return TLDAP_NO_MEMORY
;
113 filter
= talloc_asprintf_append_buffer(filter
, ")");
114 if (filter
== NULL
) {
115 return TLDAP_NO_MEMORY
;
118 rc
= tldap_search(ld
, schema_path
, TLDAP_SCOPE_SUB
, filter
,
119 attrs
, ARRAY_SIZE(attrs
), 0, NULL
, 0, NULL
, 0,
120 0, 0, 0, mem_ctx
, &msgs
);;
122 if (!TLDAP_RC_IS_SUCCESS(rc
)) {
126 for (i
=0; i
<num_oids
; i
++) {
130 num_msgs
= talloc_array_length(msgs
);
132 for (i
=0; i
<num_msgs
; i
++) {
133 struct tldap_message
*msg
= msgs
[i
];
137 if (tldap_msg_type(msg
) != TLDAP_RES_SEARCH_ENTRY
) {
138 /* Could be a TLDAP_RES_SEARCH_REFERENCE */
142 oid
= tldap_talloc_single_attribute(
143 msg
, "attributeId", msg
);
148 for (j
=0; j
<num_oids
; j
++) {
149 if (strequal(oid
, oids
[j
])) {
160 names
[j
] = tldap_talloc_single_attribute(
161 msg
, "lDAPDisplayName", mem_ctx
);
165 for (i
=0; i
<num_oids
; i
++) {
166 if (names
[i
] == NULL
) {
167 DBG_ERR("Failed to retrieve schema name for "
168 "oid [%s]. Schema mode is incorrect "
169 "for this domain.\n", oids
[i
]);
170 return TLDAP_FILTER_ERROR
;
174 return TLDAP_SUCCESS
;
177 static TLDAPRC
get_posix_schema_names(struct tldap_context
*ld
,
178 const char *schema_mode
,
180 struct idmap_ad_schema_names
**pschema
)
183 struct idmap_ad_schema_names
*schema
;
185 const char *oids_sfu
[] = {
186 ADS_ATTR_SFU_UIDNUMBER_OID
,
187 ADS_ATTR_SFU_GIDNUMBER_OID
,
188 ADS_ATTR_SFU_HOMEDIR_OID
,
189 ADS_ATTR_SFU_SHELL_OID
,
190 ADS_ATTR_SFU_GECOS_OID
,
193 const char *oids_sfu20
[] = {
194 ADS_ATTR_SFU20_UIDNUMBER_OID
,
195 ADS_ATTR_SFU20_GIDNUMBER_OID
,
196 ADS_ATTR_SFU20_HOMEDIR_OID
,
197 ADS_ATTR_SFU20_SHELL_OID
,
198 ADS_ATTR_SFU20_GECOS_OID
,
199 ADS_ATTR_SFU20_UID_OID
201 const char *oids_rfc2307
[] = {
202 ADS_ATTR_RFC2307_UIDNUMBER_OID
,
203 ADS_ATTR_RFC2307_GIDNUMBER_OID
,
204 ADS_ATTR_RFC2307_HOMEDIR_OID
,
205 ADS_ATTR_RFC2307_SHELL_OID
,
206 ADS_ATTR_RFC2307_GECOS_OID
,
207 ADS_ATTR_RFC2307_UID_OID
213 schema
= talloc(mem_ctx
, struct idmap_ad_schema_names
);
214 if (schema
== NULL
) {
215 return TLDAP_NO_MEMORY
;
218 schema_path
= get_schema_path(schema
, ld
);
219 if (schema_path
== NULL
) {
221 return TLDAP_NO_MEMORY
;
226 if ((schema_mode
!= NULL
) && (schema_mode
[0] != '\0')) {
227 if (strequal(schema_mode
, "sfu")) {
229 } else if (strequal(schema_mode
, "sfu20")) {
231 } else if (strequal(schema_mode
, "rfc2307" )) {
234 DBG_WARNING("Unknown schema mode %s\n", schema_mode
);
238 rc
= get_attrnames_by_oids(ld
, schema
, schema_path
, 6, oids
, names
);
239 TALLOC_FREE(schema_path
);
240 if (!TLDAP_RC_IS_SUCCESS(rc
)) {
245 schema
->uid
= names
[0];
246 schema
->gid
= names
[1];
247 schema
->dir
= names
[2];
248 schema
->shell
= names
[3];
249 schema
->gecos
= names
[4];
250 schema
->name
= names
[5];
254 return TLDAP_SUCCESS
;
257 static void idmap_ad_tldap_debug(void *log_private
,
258 enum tldap_debug_level level
,
262 int samba_level
= -1;
265 case TLDAP_DEBUG_FATAL
:
266 samba_level
= DBGLVL_ERR
;
268 case TLDAP_DEBUG_ERROR
:
269 samba_level
= DBGLVL_ERR
;
271 case TLDAP_DEBUG_WARNING
:
272 samba_level
= DBGLVL_WARNING
;
274 case TLDAP_DEBUG_TRACE
:
275 samba_level
= DBGLVL_DEBUG
;
279 if (CHECK_DEBUGLVL(samba_level
)) {
283 ret
= vasprintf(&s
, fmt
, ap
);
287 DEBUG(samba_level
, ("idmap_ad_tldap: %s", s
));
292 static NTSTATUS
idmap_ad_get_tldap_ctx(TALLOC_CTX
*mem_ctx
,
294 struct tldap_context
**pld
)
296 struct netr_DsRGetDCNameInfo
*dcinfo
;
297 struct sockaddr_storage dcaddr
;
298 struct cli_credentials
*creds
;
299 struct loadparm_context
*lp_ctx
;
300 struct tldap_context
*ld
;
306 status
= wb_dsgetdcname_gencache_get(mem_ctx
, domname
, &dcinfo
);
307 if (!NT_STATUS_IS_OK(status
)) {
308 DBG_DEBUG("Could not get dcinfo for %s: %s\n", domname
,
313 if (dcinfo
->dc_unc
== NULL
) {
315 return NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
;
317 if (dcinfo
->dc_unc
[0] == '\\') {
320 if (dcinfo
->dc_unc
[0] == '\\') {
324 ok
= resolve_name(dcinfo
->dc_unc
, &dcaddr
, 0x20, true);
326 DBG_DEBUG("Could not resolve name %s\n", dcinfo
->dc_unc
);
328 return NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
;
331 status
= open_socket_out(&dcaddr
, 389, 10000, &fd
);
332 if (!NT_STATUS_IS_OK(status
)) {
333 DBG_DEBUG("open_socket_out failed: %s\n", nt_errstr(status
));
338 ld
= tldap_context_create(dcinfo
, fd
);
340 DBG_DEBUG("tldap_context_create failed\n");
343 return NT_STATUS_NO_MEMORY
;
345 tldap_set_debug(ld
, idmap_ad_tldap_debug
, NULL
);
348 * Here we use or own machine account as
349 * we run as domain member.
351 status
= pdb_get_trust_credentials(lp_workgroup(),
355 if (!NT_STATUS_IS_OK(status
)) {
356 DBG_DEBUG("pdb_get_trust_credentials() failed - %s\n",
362 lp_ctx
= loadparm_init_s3(dcinfo
, loadparm_s3_helpers());
363 if (lp_ctx
== NULL
) {
364 DBG_DEBUG("loadparm_init_s3 failed\n");
366 return NT_STATUS_NO_MEMORY
;
369 rc
= tldap_gensec_bind(ld
, creds
, "ldap", dcinfo
->dc_unc
, NULL
, lp_ctx
,
370 GENSEC_FEATURE_SIGN
| GENSEC_FEATURE_SEAL
);
371 if (!TLDAP_RC_IS_SUCCESS(rc
)) {
372 DBG_DEBUG("tldap_gensec_bind failed: %s\n",
373 tldap_errstr(dcinfo
, ld
, rc
));
375 return NT_STATUS_LDAP(TLDAP_RC_V(rc
));
378 rc
= tldap_fetch_rootdse(ld
);
379 if (!TLDAP_RC_IS_SUCCESS(rc
)) {
380 DBG_DEBUG("tldap_fetch_rootdse failed: %s\n",
381 tldap_errstr(dcinfo
, ld
, rc
));
383 return NT_STATUS_LDAP(TLDAP_RC_V(rc
));
386 *pld
= talloc_move(mem_ctx
, &ld
);
391 static int idmap_ad_context_destructor(struct idmap_ad_context
*ctx
)
393 if ((ctx
->dom
!= NULL
) && (ctx
->dom
->private_data
== ctx
)) {
394 ctx
->dom
->private_data
= NULL
;
399 static NTSTATUS
idmap_ad_context_create(TALLOC_CTX
*mem_ctx
,
400 struct idmap_domain
*dom
,
402 struct idmap_ad_context
**pctx
)
404 struct idmap_ad_context
*ctx
;
405 const char *schema_mode
;
409 ctx
= talloc(mem_ctx
, struct idmap_ad_context
);
411 return NT_STATUS_NO_MEMORY
;
415 talloc_set_destructor(ctx
, idmap_ad_context_destructor
);
417 status
= idmap_ad_get_tldap_ctx(ctx
, domname
, &ctx
->ld
);
418 if (!NT_STATUS_IS_OK(status
)) {
419 DBG_DEBUG("idmap_ad_get_tldap_ctx failed: %s\n",
425 ctx
->default_nc
= get_default_nc(ctx
, ctx
->ld
);
426 if (ctx
->default_nc
== NULL
) {
427 DBG_DEBUG("No default nc\n");
432 ctx
->unix_primary_group
= idmap_config_bool(
433 domname
, "unix_primary_group", false);
434 ctx
->unix_nss_info
= idmap_config_bool(
435 domname
, "unix_nss_info", false);
437 schema_mode
= idmap_config_const_string(
438 domname
, "schema_mode", "rfc2307");
440 rc
= get_posix_schema_names(ctx
->ld
, schema_mode
, ctx
, &ctx
->schema
);
441 if (!TLDAP_RC_IS_SUCCESS(rc
)) {
442 DBG_DEBUG("get_posix_schema_names failed: %s\n",
443 tldap_errstr(ctx
, ctx
->ld
, rc
));
445 return NT_STATUS_LDAP(TLDAP_RC_V(rc
));
452 static NTSTATUS
idmap_ad_query_user(struct idmap_domain
*domain
,
453 struct wbint_userinfo
*info
)
455 struct idmap_ad_context
*ctx
;
458 char *sidstr
, *filter
;
459 const char *attrs
[4];
461 struct tldap_message
**msgs
;
463 status
= idmap_ad_get_context(domain
, &ctx
);
464 if (!NT_STATUS_IS_OK(status
)) {
468 if (!(ctx
->unix_primary_group
|| ctx
->unix_nss_info
)) {
472 attrs
[0] = ctx
->schema
->gid
;
473 attrs
[1] = ctx
->schema
->gecos
;
474 attrs
[2] = ctx
->schema
->dir
;
475 attrs
[3] = ctx
->schema
->shell
;
477 sidstr
= ldap_encode_ndr_dom_sid(talloc_tos(), &info
->user_sid
);
478 if (sidstr
== NULL
) {
479 return NT_STATUS_NO_MEMORY
;
482 filter
= talloc_asprintf(talloc_tos(), "(objectsid=%s)", sidstr
);
484 if (filter
== NULL
) {
485 return NT_STATUS_NO_MEMORY
;
488 DBG_DEBUG("Filter: [%s]\n", filter
);
490 rc
= tldap_search(ctx
->ld
, ctx
->default_nc
, TLDAP_SCOPE_SUB
, filter
,
491 attrs
, ARRAY_SIZE(attrs
), 0, NULL
, 0, NULL
, 0,
492 0, 0, 0, talloc_tos(), &msgs
);
493 if (!TLDAP_RC_IS_SUCCESS(rc
)) {
494 return NT_STATUS_LDAP(TLDAP_RC_V(rc
));
499 num_msgs
= talloc_array_length(msgs
);
501 for (i
=0; i
<num_msgs
; i
++) {
502 struct tldap_message
*msg
= msgs
[i
];
504 if (tldap_msg_type(msg
) != TLDAP_RES_SEARCH_ENTRY
) {
508 if (ctx
->unix_primary_group
) {
512 ok
= tldap_pull_uint32(msg
, ctx
->schema
->gid
, &gid
);
514 DBG_DEBUG("Setting primary group "
515 "to %"PRIu32
" from attr %s\n",
516 gid
, ctx
->schema
->gid
);
517 info
->primary_gid
= gid
;
521 if (ctx
->unix_nss_info
) {
524 attr
= tldap_talloc_single_attribute(
525 msg
, ctx
->schema
->dir
, talloc_tos());
527 info
->homedir
= talloc_move(info
, &attr
);
531 attr
= tldap_talloc_single_attribute(
532 msg
, ctx
->schema
->shell
, talloc_tos());
534 info
->shell
= talloc_move(info
, &attr
);
538 attr
= tldap_talloc_single_attribute(
539 msg
, ctx
->schema
->gecos
, talloc_tos());
541 info
->full_name
= talloc_move(info
, &attr
);
550 static NTSTATUS
idmap_ad_query_user_retry(struct idmap_domain
*domain
,
551 struct wbint_userinfo
*info
)
553 const NTSTATUS status_server_down
=
554 NT_STATUS_LDAP(TLDAP_RC_V(TLDAP_SERVER_DOWN
));
557 status
= idmap_ad_query_user(domain
, info
);
559 if (NT_STATUS_EQUAL(status
, status_server_down
)) {
560 TALLOC_FREE(domain
->private_data
);
561 status
= idmap_ad_query_user(domain
, info
);
567 static NTSTATUS
idmap_ad_initialize(struct idmap_domain
*dom
)
569 dom
->query_user
= idmap_ad_query_user_retry
;
570 dom
->private_data
= NULL
;
574 static NTSTATUS
idmap_ad_get_context(struct idmap_domain
*dom
,
575 struct idmap_ad_context
**pctx
)
577 struct idmap_ad_context
*ctx
= NULL
;
582 * Make sure we never try to use LDAP against
583 * a trusted domain as AD_DC.
585 * This shouldn't be called currently,
586 * but you never know what happens in future.
588 return NT_STATUS_REQUEST_NOT_ACCEPTED
;
591 if (dom
->private_data
!= NULL
) {
592 *pctx
= talloc_get_type_abort(dom
->private_data
,
593 struct idmap_ad_context
);
597 status
= idmap_ad_context_create(dom
, dom
, dom
->name
, &ctx
);
598 if (!NT_STATUS_IS_OK(status
)) {
599 DBG_DEBUG("idmap_ad_context_create failed: %s\n",
604 dom
->private_data
= ctx
;
609 static NTSTATUS
idmap_ad_unixids_to_sids(struct idmap_domain
*dom
,
612 struct idmap_ad_context
*ctx
;
615 struct tldap_message
**msgs
;
618 char *u_filter
, *g_filter
, *filter
;
620 const char *attrs
[] = {
623 NULL
, /* attr_uidnumber */
624 NULL
, /* attr_gidnumber */
627 status
= idmap_ad_get_context(dom
, &ctx
);
628 if (!NT_STATUS_IS_OK(status
)) {
632 attrs
[2] = ctx
->schema
->uid
;
633 attrs
[3] = ctx
->schema
->gid
;
635 u_filter
= talloc_strdup(talloc_tos(), "");
636 if (u_filter
== NULL
) {
637 return NT_STATUS_NO_MEMORY
;
640 g_filter
= talloc_strdup(talloc_tos(), "");
641 if (g_filter
== NULL
) {
642 return NT_STATUS_NO_MEMORY
;
645 for (i
=0; ids
[i
] != NULL
; i
++) {
646 struct id_map
*id
= ids
[i
];
648 id
->status
= ID_UNKNOWN
;
650 switch (id
->xid
.type
) {
652 u_filter
= talloc_asprintf_append_buffer(
653 u_filter
, "(%s=%ju)", ctx
->schema
->uid
,
654 (uintmax_t)id
->xid
.id
);
655 if (u_filter
== NULL
) {
656 return NT_STATUS_NO_MEMORY
;
662 g_filter
= talloc_asprintf_append_buffer(
663 g_filter
, "(%s=%ju)", ctx
->schema
->gid
,
664 (uintmax_t)id
->xid
.id
);
665 if (g_filter
== NULL
) {
666 return NT_STATUS_NO_MEMORY
;
672 DBG_WARNING("Unknown id type: %u\n",
673 (unsigned)id
->xid
.type
);
678 filter
= talloc_strdup(talloc_tos(), "(|");
679 if (filter
== NULL
) {
680 return NT_STATUS_NO_MEMORY
;
683 if (*u_filter
!= '\0') {
684 filter
= talloc_asprintf_append_buffer(
686 "(&(|(sAMAccountType=%d)(sAMAccountType=%d)"
687 "(sAMAccountType=%d))(|%s))",
688 ATYPE_NORMAL_ACCOUNT
, ATYPE_WORKSTATION_TRUST
,
689 ATYPE_INTERDOMAIN_TRUST
, u_filter
);
690 if (filter
== NULL
) {
691 return NT_STATUS_NO_MEMORY
;
694 TALLOC_FREE(u_filter
);
696 if (*g_filter
!= '\0') {
697 filter
= talloc_asprintf_append_buffer(
699 "(&(|(sAMAccountType=%d)(sAMAccountType=%d))(|%s))",
700 ATYPE_SECURITY_GLOBAL_GROUP
,
701 ATYPE_SECURITY_LOCAL_GROUP
,
703 if (filter
== NULL
) {
704 return NT_STATUS_NO_MEMORY
;
707 TALLOC_FREE(g_filter
);
709 filter
= talloc_asprintf_append_buffer(filter
, ")");
710 if (filter
== NULL
) {
711 return NT_STATUS_NO_MEMORY
;
714 DBG_DEBUG("Filter: [%s]\n", filter
);
716 rc
= tldap_search(ctx
->ld
, ctx
->default_nc
, TLDAP_SCOPE_SUB
, filter
,
717 attrs
, ARRAY_SIZE(attrs
), 0, NULL
, 0, NULL
, 0,
718 0, 0, 0, talloc_tos(), &msgs
);
719 if (!TLDAP_RC_IS_SUCCESS(rc
)) {
720 return NT_STATUS_LDAP(TLDAP_RC_V(rc
));
725 num_msgs
= talloc_array_length(msgs
);
727 for (i
=0; i
<num_msgs
; i
++) {
728 struct tldap_message
*msg
= msgs
[i
];
736 struct dom_sid_buf sidbuf
;
738 if (tldap_msg_type(msg
) != TLDAP_RES_SEARCH_ENTRY
) {
742 ok
= tldap_entry_dn(msg
, &dn
);
744 DBG_DEBUG("No dn found in msg %zu\n", i
);
748 ok
= tldap_pull_uint32(msg
, "sAMAccountType", &atype
);
750 DBG_DEBUG("No atype in object %s\n", dn
);
754 switch (atype
& 0xF0000000) {
755 case ATYPE_SECURITY_GLOBAL_GROUP
:
756 case ATYPE_SECURITY_LOCAL_GROUP
:
759 case ATYPE_NORMAL_ACCOUNT
:
760 case ATYPE_WORKSTATION_TRUST
:
761 case ATYPE_INTERDOMAIN_TRUST
:
765 DBG_WARNING("unrecognized SAM account type %08x\n",
770 ok
= tldap_pull_uint32(msg
, (type
== ID_TYPE_UID
) ?
771 ctx
->schema
->uid
: ctx
->schema
->gid
,
774 DBG_WARNING("No unix id in object %s\n", dn
);
778 ok
= tldap_pull_binsid(msg
, "objectSid", &sid
);
780 DBG_DEBUG("No objectSid in object %s\n", dn
);
785 for (j
=0; ids
[j
]; j
++) {
786 if ((type
== ids
[j
]->xid
.type
) &&
787 (xid
== ids
[j
]->xid
.id
)) {
793 DBG_DEBUG("Got unexpected sid %s from object %s\n",
794 dom_sid_str_buf(&sid
, &sidbuf
),
799 sid_copy(map
->sid
, &sid
);
800 map
->status
= ID_MAPPED
;
802 DBG_DEBUG("Mapped %s -> %ju (%d)\n",
803 dom_sid_str_buf(map
->sid
, &sidbuf
),
804 (uintmax_t)map
->xid
.id
, map
->xid
.type
);
812 static NTSTATUS
idmap_ad_sids_to_unixids(struct idmap_domain
*dom
,
815 struct idmap_ad_context
*ctx
;
818 struct tldap_message
**msgs
;
823 const char *attrs
[] = {
826 NULL
, /* attr_uidnumber */
827 NULL
, /* attr_gidnumber */
830 status
= idmap_ad_get_context(dom
, &ctx
);
831 if (!NT_STATUS_IS_OK(status
)) {
835 attrs
[2] = ctx
->schema
->uid
;
836 attrs
[3] = ctx
->schema
->gid
;
838 filter
= talloc_asprintf(
840 "(&(|(sAMAccountType=%d)(sAMAccountType=%d)(sAMAccountType=%d)"
841 "(sAMAccountType=%d)(sAMAccountType=%d))(|",
842 ATYPE_NORMAL_ACCOUNT
, ATYPE_WORKSTATION_TRUST
,
843 ATYPE_INTERDOMAIN_TRUST
, ATYPE_SECURITY_GLOBAL_GROUP
,
844 ATYPE_SECURITY_LOCAL_GROUP
);
845 if (filter
== NULL
) {
846 return NT_STATUS_NO_MEMORY
;
849 for (i
=0; ids
[i
]; i
++) {
852 ids
[i
]->status
= ID_UNKNOWN
;
854 sidstr
= ldap_encode_ndr_dom_sid(talloc_tos(), ids
[i
]->sid
);
855 if (sidstr
== NULL
) {
856 return NT_STATUS_NO_MEMORY
;
859 filter
= talloc_asprintf_append_buffer(
860 filter
, "(objectSid=%s)", sidstr
);
862 if (filter
== NULL
) {
863 return NT_STATUS_NO_MEMORY
;
867 filter
= talloc_asprintf_append_buffer(filter
, "))");
868 if (filter
== NULL
) {
869 return NT_STATUS_NO_MEMORY
;
872 DBG_DEBUG("Filter: [%s]\n", filter
);
874 rc
= tldap_search(ctx
->ld
, ctx
->default_nc
, TLDAP_SCOPE_SUB
, filter
,
875 attrs
, ARRAY_SIZE(attrs
), 0, NULL
, 0, NULL
, 0,
876 0, 0, 0, talloc_tos(), &msgs
);
877 if (!TLDAP_RC_IS_SUCCESS(rc
)) {
878 return NT_STATUS_LDAP(TLDAP_RC_V(rc
));
883 num_msgs
= talloc_array_length(msgs
);
885 for (i
=0; i
<num_msgs
; i
++) {
886 struct tldap_message
*msg
= msgs
[i
];
892 uint64_t account_type
, xid
;
894 struct dom_sid_buf buf
;
896 if (tldap_msg_type(msg
) != TLDAP_RES_SEARCH_ENTRY
) {
900 ok
= tldap_entry_dn(msg
, &dn
);
902 DBG_DEBUG("No dn found in msg %zu\n", i
);
906 ok
= tldap_pull_binsid(msg
, "objectSid", &sid
);
908 DBG_DEBUG("No objectSid in object %s\n", dn
);
913 for (j
=0; ids
[j
]; j
++) {
914 if (dom_sid_equal(&sid
, ids
[j
]->sid
)) {
920 DBG_DEBUG("Got unexpected sid %s from object %s\n",
921 dom_sid_str_buf(&sid
, &buf
),
926 ok
= tldap_pull_uint64(msg
, "sAMAccountType", &account_type
);
928 DBG_DEBUG("No sAMAccountType in %s\n", dn
);
932 switch (account_type
& 0xF0000000) {
933 case ATYPE_SECURITY_GLOBAL_GROUP
:
934 case ATYPE_SECURITY_LOCAL_GROUP
:
937 case ATYPE_NORMAL_ACCOUNT
:
938 case ATYPE_WORKSTATION_TRUST
:
939 case ATYPE_INTERDOMAIN_TRUST
:
943 DBG_WARNING("unrecognized SAM account type %"PRIu64
"\n",
948 ok
= tldap_pull_uint64(msg
,
949 type
== ID_TYPE_UID
?
950 ctx
->schema
->uid
: ctx
->schema
->gid
,
953 DBG_DEBUG("No xid in %s\n", dn
);
958 map
->xid
.type
= type
;
960 map
->status
= ID_MAPPED
;
962 DEBUG(10, ("Mapped %s -> %lu (%d)\n",
963 dom_sid_str_buf(map
->sid
, &buf
),
964 (unsigned long)map
->xid
.id
, map
->xid
.type
));
972 static NTSTATUS
idmap_ad_unixids_to_sids_retry(struct idmap_domain
*dom
,
975 const NTSTATUS status_server_down
=
976 NT_STATUS_LDAP(TLDAP_RC_V(TLDAP_SERVER_DOWN
));
979 status
= idmap_ad_unixids_to_sids(dom
, ids
);
981 if (NT_STATUS_EQUAL(status
, status_server_down
)) {
982 TALLOC_FREE(dom
->private_data
);
983 status
= idmap_ad_unixids_to_sids(dom
, ids
);
989 static NTSTATUS
idmap_ad_sids_to_unixids_retry(struct idmap_domain
*dom
,
992 const NTSTATUS status_server_down
=
993 NT_STATUS_LDAP(TLDAP_RC_V(TLDAP_SERVER_DOWN
));
996 status
= idmap_ad_sids_to_unixids(dom
, ids
);
998 if (NT_STATUS_EQUAL(status
, status_server_down
)) {
999 TALLOC_FREE(dom
->private_data
);
1000 status
= idmap_ad_sids_to_unixids(dom
, ids
);
1006 static struct idmap_methods ad_methods
= {
1007 .init
= idmap_ad_initialize
,
1008 .unixids_to_sids
= idmap_ad_unixids_to_sids_retry
,
1009 .sids_to_unixids
= idmap_ad_sids_to_unixids_retry
,
1013 NTSTATUS
idmap_ad_init(TALLOC_CTX
*ctx
)
1017 status
= smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION
,
1019 if (!NT_STATUS_IS_OK(status
)) {
1023 status
= idmap_ad_nss_init(ctx
);
1024 if (!NT_STATUS_IS_OK(status
)) {
1028 return NT_STATUS_OK
;