source3/winbindd/idmap_ad.c

   1 /*
   2  * idmap_ad: map between Active Directory and RFC 2307 accounts
   3  *
   4  * Copyright (C) Volker Lendecke 2015
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; either version 3 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21 #include "winbindd.h"
  22 #include "idmap.h"
  23 #include "tldap_gensec_bind.h"
  24 #include "tldap_util.h"
  25 #include "passdb.h"
  26 #include "lib/param/param.h"
  27 #include "utils/net.h"
  28 #include "auth/gensec/gensec.h"
  29 #include "librpc/gen_ndr/ndr_netlogon.h"
  30 #include "libads/ldap_schema_oids.h"
  31 #include "../libds/common/flags.h"
  32 #include "libcli/ldap/ldap_ndr.h"
  33 #include "libcli/security/dom_sid.h"
  34
  35 struct idmap_ad_schema_names;
  36
  37 struct idmap_ad_context {
  38         struct idmap_domain *dom;
  39         struct tldap_context *ld;
  40         struct idmap_ad_schema_names *schema;
  41         const char *default_nc;
  42
  43         bool unix_primary_group;
  44         bool unix_nss_info;
  45 };
  46
  47 static NTSTATUS idmap_ad_get_context(struct idmap_domain *dom,
  48                                      struct idmap_ad_context **pctx);
  49
  50 static char *get_schema_path(TALLOC_CTX *mem_ctx, struct tldap_context *ld)
  51 {
  52         struct tldap_message *rootdse;
  53
  54         rootdse = tldap_rootdse(ld);
  55         if (rootdse == NULL) {
  56                 return NULL;
  57         }
  58
  59         return tldap_talloc_single_attribute(rootdse, "schemaNamingContext",
  60                                              mem_ctx);
  61 }
  62
  63 static char *get_default_nc(TALLOC_CTX *mem_ctx, struct tldap_context *ld)
  64 {
  65         struct tldap_message *rootdse;
  66
  67         rootdse = tldap_rootdse(ld);
  68         if (rootdse == NULL) {
  69                 return NULL;
  70         }
  71
  72         return tldap_talloc_single_attribute(rootdse, "defaultNamingContext",
  73                                              mem_ctx);
  74 }
  75
  76 struct idmap_ad_schema_names {
  77         char *name;
  78         char *uid;
  79         char *gid;
  80         char *gecos;
  81         char *dir;
  82         char *shell;
  83 };
  84
  85 static TLDAPRC get_attrnames_by_oids(struct tldap_context *ld,
  86                                      TALLOC_CTX *mem_ctx,
  87                                      const char *schema_path,
  88                                      size_t num_oids,
  89                                      const char **oids,
  90                                      char **names)
  91 {
  92         char *filter;
  93         const char *attrs[] = { "lDAPDisplayName", "attributeId" };
  94         size_t i;
  95         TLDAPRC rc;
  96         struct tldap_message **msgs;
  97         size_t num_msgs;
  98
  99         filter = talloc_strdup(mem_ctx, "(|");
 100         if (filter == NULL) {
 101                 return TLDAP_NO_MEMORY;
 102         }
 103
 104         for (i=0; i<num_oids; i++) {
 105                 filter = talloc_asprintf_append_buffer(
 106                         filter, "(attributeId=%s)", oids[i]);
 107                 if (filter == NULL) {
 108                         return TLDAP_NO_MEMORY;
 109                 }
 110         }
 111
 112         filter = talloc_asprintf_append_buffer(filter, ")");
 113         if (filter == NULL) {
 114                 return TLDAP_NO_MEMORY;
 115         }
 116
 117         rc = tldap_search(ld, schema_path, TLDAP_SCOPE_SUB, filter,
 118                           attrs, ARRAY_SIZE(attrs), 0, NULL, 0, NULL, 0,
 119                           0, 0, 0, mem_ctx, &msgs);;
 120         TALLOC_FREE(filter);
 121         if (!TLDAP_RC_IS_SUCCESS(rc)) {
 122                 return rc;
 123         }
 124
 125         for (i=0; i<num_oids; i++) {
 126                 names[i] = NULL;
 127         }
 128
 129         num_msgs = talloc_array_length(msgs);
 130
 131         for (i=0; i<num_msgs; i++) {
 132                 struct tldap_message *msg = msgs[i];
 133                 char *oid;
 134                 size_t j;
 135
 136                 if (tldap_msg_type(msg) != TLDAP_RES_SEARCH_ENTRY) {
 137                         /* Could be a TLDAP_RES_SEARCH_REFERENCE */
 138                         continue;
 139                 }
 140
 141                 oid = tldap_talloc_single_attribute(
 142                         msg, "attributeId", msg);
 143                 if (oid == NULL) {
 144                         continue;
 145                 }
 146
 147                 for (j=0; j<num_oids; j++) {
 148                         if (strequal(oid, oids[j])) {
 149                                 break;
 150                         }
 151                 }
 152                 TALLOC_FREE(oid);
 153
 154                 if (j == num_oids) {
 155                         /* not found */
 156                         continue;
 157                 }
 158
 159                 names[j] = tldap_talloc_single_attribute(
 160                         msg, "lDAPDisplayName", mem_ctx);
 161         }
 162
 163         TALLOC_FREE(msgs);
 164
 165         return TLDAP_SUCCESS;
 166 }
 167
 168 static TLDAPRC get_posix_schema_names(struct tldap_context *ld,
 169                                       const char *schema_mode,
 170                                       TALLOC_CTX *mem_ctx,
 171                                       struct idmap_ad_schema_names **pschema)
 172 {
 173         char *schema_path;
 174         struct idmap_ad_schema_names *schema;
 175         char *names[6];
 176         const char *oids_sfu[] = {
 177                 ADS_ATTR_SFU_UIDNUMBER_OID,
 178                 ADS_ATTR_SFU_GIDNUMBER_OID,
 179                 ADS_ATTR_SFU_HOMEDIR_OID,
 180                 ADS_ATTR_SFU_SHELL_OID,
 181                 ADS_ATTR_SFU_GECOS_OID,
 182                 ADS_ATTR_SFU_UID_OID
 183         };
 184         const char *oids_sfu20[] = {
 185                 ADS_ATTR_SFU20_UIDNUMBER_OID,
 186                 ADS_ATTR_SFU20_GIDNUMBER_OID,
 187                 ADS_ATTR_SFU20_HOMEDIR_OID,
 188                 ADS_ATTR_SFU20_SHELL_OID,
 189                 ADS_ATTR_SFU20_GECOS_OID,
 190                 ADS_ATTR_SFU20_UID_OID
 191         };
 192         const char *oids_rfc2307[] = {
 193                 ADS_ATTR_RFC2307_UIDNUMBER_OID,
 194                 ADS_ATTR_RFC2307_GIDNUMBER_OID,
 195                 ADS_ATTR_RFC2307_HOMEDIR_OID,
 196                 ADS_ATTR_RFC2307_SHELL_OID,
 197                 ADS_ATTR_RFC2307_GECOS_OID,
 198                 ADS_ATTR_RFC2307_UID_OID
 199         };
 200         const char **oids;
 201
 202         TLDAPRC rc;
 203
 204         schema = talloc(mem_ctx, struct idmap_ad_schema_names);
 205         if (schema == NULL) {
 206                 return TLDAP_NO_MEMORY;
 207         }
 208
 209         schema_path = get_schema_path(schema, ld);
 210         if (schema_path == NULL) {
 211                 TALLOC_FREE(schema);
 212                 return TLDAP_NO_MEMORY;
 213         }
 214
 215         oids = oids_rfc2307;
 216
 217         if ((schema_mode != NULL) && (schema_mode[0] != '\0')) {
 218                 if (strequal(schema_mode, "sfu")) {
 219                         oids = oids_sfu;
 220                 } else if (strequal(schema_mode, "sfu20")) {
 221                         oids = oids_sfu20;
 222                 } else if (strequal(schema_mode, "rfc2307" )) {
 223                         oids = oids_rfc2307;
 224                 } else {
 225                         DBG_WARNING("Unknown schema mode %s\n", schema_mode);
 226                 }
 227         }
 228
 229         rc = get_attrnames_by_oids(ld, schema, schema_path, 6, oids, names);
 230         TALLOC_FREE(schema_path);
 231         if (!TLDAP_RC_IS_SUCCESS(rc)) {
 232                 TALLOC_FREE(schema);
 233                 return rc;
 234         }
 235
 236         schema->uid = names[0];
 237         schema->gid = names[1];
 238         schema->dir = names[2];
 239         schema->shell = names[3];
 240         schema->gecos = names[4];
 241         schema->name = names[5];
 242
 243         *pschema = schema;
 244
 245         return TLDAP_SUCCESS;
 246 }
 247
 248 static NTSTATUS idmap_ad_get_tldap_ctx(TALLOC_CTX *mem_ctx,
 249                                        const char *domname,
 250                                        struct tldap_context **pld)
 251 {
 252         struct netr_DsRGetDCNameInfo *dcinfo;
 253         struct sockaddr_storage dcaddr;
 254         struct cli_credentials *creds;
 255         struct loadparm_context *lp_ctx;
 256         struct tldap_context *ld;
 257         int fd;
 258         NTSTATUS status;
 259         bool ok;
 260         TLDAPRC rc;
 261
 262         status = wb_dsgetdcname_gencache_get(mem_ctx, domname, &dcinfo);
 263         if (!NT_STATUS_IS_OK(status)) {
 264                 DBG_DEBUG("Could not get dcinfo for %s: %s\n", domname,
 265                           nt_errstr(status));
 266                 return status;
 267         }
 268
 269         if (dcinfo->dc_unc == NULL) {
 270                 TALLOC_FREE(dcinfo);
 271                 return NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
 272         }
 273         if (dcinfo->dc_unc[0] == '\\') {
 274                 dcinfo->dc_unc += 1;
 275         }
 276         if (dcinfo->dc_unc[0] == '\\') {
 277                 dcinfo->dc_unc += 1;
 278         }
 279
 280         ok = resolve_name(dcinfo->dc_unc, &dcaddr, 0x20, true);
 281         if (!ok) {
 282                 DBG_DEBUG("Could not resolve name %s\n", dcinfo->dc_unc);
 283                 TALLOC_FREE(dcinfo);
 284                 return NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
 285         }
 286
 287         status = open_socket_out(&dcaddr, 389, 10000, &fd);
 288         if (!NT_STATUS_IS_OK(status)) {
 289                 DBG_DEBUG("open_socket_out failed: %s\n", nt_errstr(status));
 290                 TALLOC_FREE(dcinfo);
 291                 return status;
 292         }
 293
 294         ld = tldap_context_create(dcinfo, fd);
 295         if (ld == NULL) {
 296                 DBG_DEBUG("tldap_context_create failed\n");
 297                 close(fd);
 298                 TALLOC_FREE(dcinfo);
 299                 return NT_STATUS_NO_MEMORY;
 300         }
 301
 302         /*
 303          * Here we use or own machine account as
 304          * we run as domain member.
 305          */
 306         status = pdb_get_trust_credentials(lp_workgroup(),
 307                                            lp_realm(),
 308                                            dcinfo,
 309                                            &creds);
 310         if (!NT_STATUS_IS_OK(status)) {
 311                 DBG_DEBUG("pdb_get_trust_credentials() failed - %s\n",
 312                           nt_errstr(status));
 313                 TALLOC_FREE(dcinfo);
 314                 return status;
 315         }
 316
 317         lp_ctx = loadparm_init_s3(dcinfo, loadparm_s3_helpers());
 318         if (lp_ctx == NULL) {
 319                 DBG_DEBUG("loadparm_init_s3 failed\n");
 320                 TALLOC_FREE(dcinfo);
 321                 return NT_STATUS_NO_MEMORY;
 322         }
 323
 324         rc = tldap_gensec_bind(ld, creds, "ldap", dcinfo->dc_unc, NULL, lp_ctx,
 325                                GENSEC_FEATURE_SIGN | GENSEC_FEATURE_SEAL);
 326         if (!TLDAP_RC_IS_SUCCESS(rc)) {
 327                 DBG_DEBUG("tldap_gensec_bind failed: %s\n",
 328                           tldap_errstr(dcinfo, ld, rc));
 329                 TALLOC_FREE(dcinfo);
 330                 return NT_STATUS_LDAP(TLDAP_RC_V(rc));
 331         }
 332
 333         rc = tldap_fetch_rootdse(ld);
 334         if (!TLDAP_RC_IS_SUCCESS(rc)) {
 335                 DBG_DEBUG("tldap_fetch_rootdse failed: %s\n",
 336                           tldap_errstr(dcinfo, ld, rc));
 337                 TALLOC_FREE(dcinfo);
 338                 return NT_STATUS_LDAP(TLDAP_RC_V(rc));
 339         }
 340
 341         *pld = talloc_move(mem_ctx, &ld);
 342         TALLOC_FREE(dcinfo);
 343         return NT_STATUS_OK;
 344 }
 345
 346 static int idmap_ad_context_destructor(struct idmap_ad_context *ctx)
 347 {
 348         if ((ctx->dom != NULL) && (ctx->dom->private_data == ctx)) {
 349                 ctx->dom->private_data = NULL;
 350         }
 351         return 0;
 352 }
 353
 354 static NTSTATUS idmap_ad_context_create(TALLOC_CTX *mem_ctx,
 355                                         struct idmap_domain *dom,
 356                                         const char *domname,
 357                                         struct idmap_ad_context **pctx)
 358 {
 359         struct idmap_ad_context *ctx;
 360         const char *schema_mode;
 361         NTSTATUS status;
 362         TLDAPRC rc;
 363
 364         ctx = talloc(mem_ctx, struct idmap_ad_context);
 365         if (ctx == NULL) {
 366                 return NT_STATUS_NO_MEMORY;
 367         }
 368         ctx->dom = dom;
 369
 370         talloc_set_destructor(ctx, idmap_ad_context_destructor);
 371
 372         status = idmap_ad_get_tldap_ctx(ctx, domname, &ctx->ld);
 373         if (!NT_STATUS_IS_OK(status)) {
 374                 DBG_DEBUG("idmap_ad_get_tldap_ctx failed: %s\n",
 375                           nt_errstr(status));
 376                 TALLOC_FREE(ctx);
 377                 return status;
 378         }
 379
 380         ctx->default_nc = get_default_nc(ctx, ctx->ld);
 381         if (ctx->default_nc == NULL) {
 382                 DBG_DEBUG("No default nc\n");
 383                 TALLOC_FREE(ctx);
 384                 return status;
 385         }
 386
 387         ctx->unix_primary_group = idmap_config_bool(
 388                 domname, "unix_primary_group", false);
 389         ctx->unix_nss_info = idmap_config_bool(
 390                 domname, "unix_nss_info", false);
 391
 392         schema_mode = idmap_config_const_string(
 393                 domname, "schema_mode", "rfc2307");
 394
 395         rc = get_posix_schema_names(ctx->ld, schema_mode, ctx, &ctx->schema);
 396         if (!TLDAP_RC_IS_SUCCESS(rc)) {
 397                 DBG_DEBUG("get_posix_schema_names failed: %s\n",
 398                           tldap_errstr(ctx, ctx->ld, rc));
 399                 TALLOC_FREE(ctx);
 400                 return NT_STATUS_LDAP(TLDAP_RC_V(rc));
 401         }
 402
 403         *pctx = ctx;
 404         return NT_STATUS_OK;
 405 }
 406
 407 static NTSTATUS idmap_ad_query_user(struct idmap_domain *domain,
 408                                     struct wbint_userinfo *info)
 409 {
 410         struct idmap_ad_context *ctx;
 411         TLDAPRC rc;
 412         NTSTATUS status;
 413         char *sidstr, *filter;
 414         const char *attrs[4];
 415         size_t i, num_msgs;
 416         struct tldap_message **msgs;
 417
 418         status = idmap_ad_get_context(domain, &ctx);
 419         if (!NT_STATUS_IS_OK(status)) {
 420                 return status;
 421         }
 422
 423         if (!(ctx->unix_primary_group || ctx->unix_nss_info)) {
 424                 return NT_STATUS_OK;
 425         }
 426
 427         attrs[0] = ctx->schema->gid;
 428         attrs[1] = ctx->schema->gecos;
 429         attrs[2] = ctx->schema->dir;
 430         attrs[3] = ctx->schema->shell;
 431
 432         sidstr = ldap_encode_ndr_dom_sid(talloc_tos(), &info->user_sid);
 433         if (sidstr == NULL) {
 434                 return NT_STATUS_NO_MEMORY;
 435         }
 436
 437         filter = talloc_asprintf(talloc_tos(), "(objectsid=%s)", sidstr);
 438         TALLOC_FREE(sidstr);
 439         if (filter == NULL) {
 440                 return NT_STATUS_NO_MEMORY;
 441         }
 442
 443         DBG_DEBUG("Filter: [%s]\n", filter);
 444
 445         rc = tldap_search(ctx->ld, ctx->default_nc, TLDAP_SCOPE_SUB, filter,
 446                           attrs, ARRAY_SIZE(attrs), 0, NULL, 0, NULL, 0,
 447                           0, 0, 0, talloc_tos(), &msgs);
 448         if (!TLDAP_RC_IS_SUCCESS(rc)) {
 449                 return NT_STATUS_LDAP(TLDAP_RC_V(rc));
 450         }
 451
 452         TALLOC_FREE(filter);
 453
 454         num_msgs = talloc_array_length(msgs);
 455
 456         for (i=0; i<num_msgs; i++) {
 457                 struct tldap_message *msg = msgs[i];
 458
 459                 if (tldap_msg_type(msg) != TLDAP_RES_SEARCH_ENTRY) {
 460                         continue;
 461                 }
 462
 463                 if (ctx->unix_primary_group) {
 464                         bool ok;
 465                         uint32_t gid;
 466
 467                         ok = tldap_pull_uint32(msg, ctx->schema->gid, &gid);
 468                         if (ok) {
 469                                 DBG_DEBUG("Setting primary group "
 470                                           "to %"PRIu32" from attr %s\n",
 471                                           gid, ctx->schema->gid);
 472                                 info->primary_gid = gid;
 473                         }
 474                 }
 475
 476                 if (ctx->unix_nss_info) {
 477                         char *attr;
 478
 479                         attr = tldap_talloc_single_attribute(
 480                                 msg, ctx->schema->dir, talloc_tos());
 481                         if (attr != NULL) {
 482                                 info->homedir = talloc_move(info, &attr);
 483                         }
 484                         TALLOC_FREE(attr);
 485
 486                         attr = tldap_talloc_single_attribute(
 487                                 msg, ctx->schema->shell, talloc_tos());
 488                         if (attr != NULL) {
 489                                 info->shell = talloc_move(info, &attr);
 490                         }
 491                         TALLOC_FREE(attr);
 492
 493                         attr = tldap_talloc_single_attribute(
 494                                 msg, ctx->schema->gecos, talloc_tos());
 495                         if (attr != NULL) {
 496                                 info->full_name = talloc_move(info, &attr);
 497                         }
 498                         TALLOC_FREE(attr);
 499                 }
 500         }
 501
 502         return NT_STATUS_OK;
 503 }
 504
 505 static NTSTATUS idmap_ad_query_user_retry(struct idmap_domain *domain,
 506                                           struct wbint_userinfo *info)
 507 {
 508         const NTSTATUS status_server_down =
 509                 NT_STATUS_LDAP(TLDAP_RC_V(TLDAP_SERVER_DOWN));
 510         NTSTATUS status;
 511
 512         status = idmap_ad_query_user(domain, info);
 513
 514         if (NT_STATUS_EQUAL(status, status_server_down)) {
 515                 TALLOC_FREE(domain->private_data);
 516                 status = idmap_ad_query_user(domain, info);
 517         }
 518
 519         return status;
 520 }
 521
 522 static NTSTATUS idmap_ad_initialize(struct idmap_domain *dom)
 523 {
 524         dom->query_user = idmap_ad_query_user_retry;
 525         dom->private_data = NULL;
 526         return NT_STATUS_OK;
 527 }
 528
 529 static NTSTATUS idmap_ad_get_context(struct idmap_domain *dom,
 530                                      struct idmap_ad_context **pctx)
 531 {
 532         struct idmap_ad_context *ctx = NULL;
 533         NTSTATUS status;
 534
 535         if (IS_AD_DC) {
 536                 /*
 537                  * Make sure we never try to use LDAP against
 538                  * a trusted domain as AD_DC.
 539                  *
 540                  * This shouldn't be called currently,
 541                  * but you never know what happens in future.
 542                  */
 543                 return NT_STATUS_REQUEST_NOT_ACCEPTED;
 544         }
 545
 546         if (dom->private_data != NULL) {
 547                 *pctx = talloc_get_type_abort(dom->private_data,
 548                                               struct idmap_ad_context);
 549                 return NT_STATUS_OK;
 550         }
 551
 552         status = idmap_ad_context_create(dom, dom, dom->name, &ctx);
 553         if (!NT_STATUS_IS_OK(status)) {
 554                 DBG_DEBUG("idmap_ad_context_create failed: %s\n",
 555                           nt_errstr(status));
 556                 return status;
 557         }
 558
 559         dom->private_data = ctx;
 560         *pctx = ctx;
 561         return NT_STATUS_OK;
 562 }
 563
 564 static NTSTATUS idmap_ad_unixids_to_sids(struct idmap_domain *dom,
 565                                          struct id_map **ids)
 566 {
 567         struct idmap_ad_context *ctx;
 568         TLDAPRC rc;
 569         NTSTATUS status;
 570         struct tldap_message **msgs;
 571
 572         size_t i, num_msgs;
 573         char *u_filter, *g_filter, *filter;
 574
 575         const char *attrs[] = {
 576                 "sAMAccountType",
 577                 "objectSid",
 578                 NULL, /* attr_uidnumber */
 579                 NULL, /* attr_gidnumber */
 580         };
 581
 582         status = idmap_ad_get_context(dom, &ctx);
 583         if (!NT_STATUS_IS_OK(status)) {
 584                 return status;
 585         }
 586
 587         attrs[2] = ctx->schema->uid;
 588         attrs[3] = ctx->schema->gid;
 589
 590         u_filter = talloc_strdup(talloc_tos(), "");
 591         if (u_filter == NULL) {
 592                 return NT_STATUS_NO_MEMORY;
 593         }
 594
 595         g_filter = talloc_strdup(talloc_tos(), "");
 596         if (g_filter == NULL) {
 597                 return NT_STATUS_NO_MEMORY;
 598         }
 599
 600         for (i=0; ids[i] != NULL; i++) {
 601                 struct id_map *id = ids[i];
 602
 603                 id->status = ID_UNKNOWN;
 604
 605                 switch (id->xid.type) {
 606                     case ID_TYPE_UID: {
 607                             u_filter = talloc_asprintf_append_buffer(
 608                                     u_filter, "(%s=%ju)", ctx->schema->uid,
 609                                     (uintmax_t)id->xid.id);
 610                             if (u_filter == NULL) {
 611                                     return NT_STATUS_NO_MEMORY;
 612                             }
 613                             break;
 614                     }
 615
 616                     case ID_TYPE_GID: {
 617                             g_filter = talloc_asprintf_append_buffer(
 618                                     g_filter, "(%s=%ju)", ctx->schema->gid,
 619                                     (uintmax_t)id->xid.id);
 620                             if (g_filter == NULL) {
 621                                     return NT_STATUS_NO_MEMORY;
 622                             }
 623                             break;
 624                     }
 625
 626                     default:
 627                             DBG_WARNING("Unknown id type: %u\n",
 628                                         (unsigned)id->xid.type);
 629                             break;
 630                 }
 631         }
 632
 633         filter = talloc_strdup(talloc_tos(), "(|");
 634         if (filter == NULL) {
 635                 return NT_STATUS_NO_MEMORY;
 636         }
 637
 638         if (*u_filter != '\0') {
 639                 filter = talloc_asprintf_append_buffer(
 640                         filter,
 641                         "(&(|(sAMAccountType=%d)(sAMAccountType=%d)"
 642                         "(sAMAccountType=%d))(|%s))",
 643                         ATYPE_NORMAL_ACCOUNT, ATYPE_WORKSTATION_TRUST,
 644                         ATYPE_INTERDOMAIN_TRUST, u_filter);
 645                 if (filter == NULL) {
 646                         return NT_STATUS_NO_MEMORY;
 647                 }
 648         }
 649         TALLOC_FREE(u_filter);
 650
 651         if (*g_filter != '\0') {
 652                 filter = talloc_asprintf_append_buffer(
 653                         filter,
 654                         "(&(|(sAMAccountType=%d)(sAMAccountType=%d))(|%s))",
 655                         ATYPE_SECURITY_GLOBAL_GROUP,
 656                         ATYPE_SECURITY_LOCAL_GROUP,
 657                         g_filter);
 658                 if (filter == NULL) {
 659                         return NT_STATUS_NO_MEMORY;
 660                 }
 661         }
 662         TALLOC_FREE(g_filter);
 663
 664         filter = talloc_asprintf_append_buffer(filter, ")");
 665         if (filter == NULL) {
 666                 return NT_STATUS_NO_MEMORY;
 667         }
 668
 669         DBG_DEBUG("Filter: [%s]\n", filter);
 670
 671         rc = tldap_search(ctx->ld, ctx->default_nc, TLDAP_SCOPE_SUB, filter,
 672                           attrs, ARRAY_SIZE(attrs), 0, NULL, 0, NULL, 0,
 673                           0, 0, 0, talloc_tos(), &msgs);
 674         if (!TLDAP_RC_IS_SUCCESS(rc)) {
 675                 return NT_STATUS_LDAP(TLDAP_RC_V(rc));
 676         }
 677
 678         TALLOC_FREE(filter);
 679
 680         num_msgs = talloc_array_length(msgs);
 681
 682         for (i=0; i<num_msgs; i++) {
 683                 struct tldap_message *msg = msgs[i];
 684                 char *dn;
 685                 struct id_map *map;
 686                 struct dom_sid sid;
 687                 size_t j;
 688                 bool ok;
 689                 uint32_t atype, xid;
 690                 enum id_type type;
 691
 692                 if (tldap_msg_type(msg) != TLDAP_RES_SEARCH_ENTRY) {
 693                         continue;
 694                 }
 695
 696                 ok = tldap_entry_dn(msg, &dn);
 697                 if (!ok) {
 698                         DBG_DEBUG("No dn found in msg %zu\n", i);
 699                         continue;
 700                 }
 701
 702                 ok = tldap_pull_uint32(msg, "sAMAccountType", &atype);
 703                 if (!ok) {
 704                         DBG_DEBUG("No atype in object %s\n", dn);
 705                         continue;
 706                 }
 707
 708                 switch (atype & 0xF0000000) {
 709                     case ATYPE_SECURITY_GLOBAL_GROUP:
 710                     case ATYPE_SECURITY_LOCAL_GROUP:
 711                             type = ID_TYPE_GID;
 712                             break;
 713                     case ATYPE_NORMAL_ACCOUNT:
 714                     case ATYPE_WORKSTATION_TRUST:
 715                     case ATYPE_INTERDOMAIN_TRUST:
 716                             type = ID_TYPE_UID;
 717                             break;
 718                     default:
 719                             DBG_WARNING("unrecognized SAM account type %08x\n",
 720                                         atype);
 721                         continue;
 722                 }
 723
 724                 ok = tldap_pull_uint32(msg, (type == ID_TYPE_UID) ?
 725                                        ctx->schema->uid : ctx->schema->gid,
 726                                        &xid);
 727                 if (!ok) {
 728                         DBG_WARNING("No unix id in object %s\n", dn);
 729                         continue;
 730                 }
 731
 732                 ok = tldap_pull_binsid(msg, "objectSid", &sid);
 733                 if (!ok) {
 734                         DBG_DEBUG("No objectSid in object %s\n", dn);
 735                         continue;
 736                 }
 737
 738                 map = NULL;
 739                 for (j=0; ids[j]; j++) {
 740                         if ((type == ids[j]->xid.type) &&
 741                             (xid == ids[j]->xid.id)) {
 742                                 map = ids[j];
 743                                 break;
 744                         }
 745                 }
 746                 if (map == NULL) {
 747                         DBG_DEBUG("Got unexpected sid %s from object %s\n",
 748                                   sid_string_tos(&sid), dn);
 749                         continue;
 750                 }
 751
 752                 sid_copy(map->sid, &sid);
 753                 map->status = ID_MAPPED;
 754
 755                 DBG_DEBUG("Mapped %s -> %ju (%d)\n", sid_string_dbg(map->sid),
 756                           (uintmax_t)map->xid.id, map->xid.type);
 757         }
 758
 759         TALLOC_FREE(msgs);
 760
 761         return NT_STATUS_OK;
 762 }
 763
 764 static NTSTATUS idmap_ad_sids_to_unixids(struct idmap_domain *dom,
 765                                          struct id_map **ids)
 766 {
 767         struct idmap_ad_context *ctx;
 768         TLDAPRC rc;
 769         NTSTATUS status;
 770         struct tldap_message **msgs;
 771
 772         char *filter;
 773         size_t i, num_msgs;
 774
 775         const char *attrs[] = {
 776                 "sAMAccountType",
 777                 "objectSid",
 778                 NULL, /* attr_uidnumber */
 779                 NULL, /* attr_gidnumber */
 780         };
 781
 782         status = idmap_ad_get_context(dom, &ctx);
 783         if (!NT_STATUS_IS_OK(status)) {
 784                 return status;
 785         }
 786
 787         attrs[2] = ctx->schema->uid;
 788         attrs[3] = ctx->schema->gid;
 789
 790         filter = talloc_asprintf(
 791                 talloc_tos(),
 792                 "(&(|(sAMAccountType=%d)(sAMAccountType=%d)(sAMAccountType=%d)"
 793                 "(sAMAccountType=%d)(sAMAccountType=%d))(|",
 794                 ATYPE_NORMAL_ACCOUNT, ATYPE_WORKSTATION_TRUST,
 795                 ATYPE_INTERDOMAIN_TRUST, ATYPE_SECURITY_GLOBAL_GROUP,
 796                 ATYPE_SECURITY_LOCAL_GROUP);
 797         if (filter == NULL) {
 798                 return NT_STATUS_NO_MEMORY;
 799         }
 800
 801         for (i=0; ids[i]; i++) {
 802                 char *sidstr;
 803
 804                 ids[i]->status = ID_UNKNOWN;
 805
 806                 sidstr = ldap_encode_ndr_dom_sid(talloc_tos(), ids[i]->sid);
 807                 if (sidstr == NULL) {
 808                         return NT_STATUS_NO_MEMORY;
 809                 }
 810
 811                 filter = talloc_asprintf_append_buffer(
 812                         filter, "(objectSid=%s)", sidstr);
 813                 TALLOC_FREE(sidstr);
 814                 if (filter == NULL) {
 815                         return NT_STATUS_NO_MEMORY;
 816                 }
 817         }
 818
 819         filter = talloc_asprintf_append_buffer(filter, "))");
 820         if (filter == NULL) {
 821                 return NT_STATUS_NO_MEMORY;
 822         }
 823
 824         DBG_DEBUG("Filter: [%s]\n", filter);
 825
 826         rc = tldap_search(ctx->ld, ctx->default_nc, TLDAP_SCOPE_SUB, filter,
 827                           attrs, ARRAY_SIZE(attrs), 0, NULL, 0, NULL, 0,
 828                           0, 0, 0, talloc_tos(), &msgs);
 829         if (!TLDAP_RC_IS_SUCCESS(rc)) {
 830                 return NT_STATUS_LDAP(TLDAP_RC_V(rc));
 831         }
 832
 833         TALLOC_FREE(filter);
 834
 835         num_msgs = talloc_array_length(msgs);
 836
 837         for (i=0; i<num_msgs; i++) {
 838                 struct tldap_message *msg = msgs[i];
 839                 char *dn;
 840                 struct id_map *map;
 841                 struct dom_sid sid;
 842                 size_t j;
 843                 bool ok;
 844                 uint64_t account_type, xid;
 845                 enum id_type type;
 846
 847                 if (tldap_msg_type(msg) != TLDAP_RES_SEARCH_ENTRY) {
 848                         continue;
 849                 }
 850
 851                 ok = tldap_entry_dn(msg, &dn);
 852                 if (!ok) {
 853                         DBG_DEBUG("No dn found in msg %zu\n", i);
 854                         continue;
 855                 }
 856
 857                 ok = tldap_pull_binsid(msg, "objectSid", &sid);
 858                 if (!ok) {
 859                         DBG_DEBUG("No objectSid in object %s\n", dn);
 860                         continue;
 861                 }
 862
 863                 map = NULL;
 864                 for (j=0; ids[j]; j++) {
 865                         if (dom_sid_equal(&sid, ids[j]->sid)) {
 866                                 map = ids[j];
 867                                 break;
 868                         }
 869                 }
 870                 if (map == NULL) {
 871                         DBG_DEBUG("Got unexpected sid %s from object %s\n",
 872                                   sid_string_tos(&sid), dn);
 873                         continue;
 874                 }
 875
 876                 ok = tldap_pull_uint64(msg, "sAMAccountType", &account_type);
 877                 if (!ok) {
 878                         DBG_DEBUG("No sAMAccountType in %s\n", dn);
 879                         continue;
 880                 }
 881
 882                 switch (account_type & 0xF0000000) {
 883                 case ATYPE_SECURITY_GLOBAL_GROUP:
 884                 case ATYPE_SECURITY_LOCAL_GROUP:
 885                         type = ID_TYPE_GID;
 886                         break;
 887                 case ATYPE_NORMAL_ACCOUNT:
 888                 case ATYPE_WORKSTATION_TRUST:
 889                 case ATYPE_INTERDOMAIN_TRUST:
 890                         type = ID_TYPE_UID;
 891                         break;
 892                 default:
 893                         DBG_WARNING("unrecognized SAM account type %"PRIu64"\n",
 894                                     account_type);
 895                         continue;
 896                 }
 897
 898                 ok = tldap_pull_uint64(msg,
 899                                        type == ID_TYPE_UID ?
 900                                        ctx->schema->uid : ctx->schema->gid,
 901                                        &xid);
 902                 if (!ok) {
 903                         DBG_DEBUG("No xid in %s\n", dn);
 904                         continue;
 905                 }
 906
 907                 /* mapped */
 908                 map->xid.type = type;
 909                 map->xid.id = xid;
 910                 map->status = ID_MAPPED;
 911
 912                 DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
 913                            (unsigned long)map->xid.id, map->xid.type));
 914         }
 915
 916         TALLOC_FREE(msgs);
 917
 918         return NT_STATUS_OK;
 919 }
 920
 921 static NTSTATUS idmap_ad_unixids_to_sids_retry(struct idmap_domain *dom,
 922                                                struct id_map **ids)
 923 {
 924         const NTSTATUS status_server_down =
 925                 NT_STATUS_LDAP(TLDAP_RC_V(TLDAP_SERVER_DOWN));
 926         NTSTATUS status;
 927
 928         status = idmap_ad_unixids_to_sids(dom, ids);
 929
 930         if (NT_STATUS_EQUAL(status, status_server_down)) {
 931                 TALLOC_FREE(dom->private_data);
 932                 status = idmap_ad_unixids_to_sids(dom, ids);
 933         }
 934
 935         return status;
 936 }
 937
 938 static NTSTATUS idmap_ad_sids_to_unixids_retry(struct idmap_domain *dom,
 939                                                struct id_map **ids)
 940 {
 941         const NTSTATUS status_server_down =
 942                 NT_STATUS_LDAP(TLDAP_RC_V(TLDAP_SERVER_DOWN));
 943         NTSTATUS status;
 944
 945         status = idmap_ad_sids_to_unixids(dom, ids);
 946
 947         if (NT_STATUS_EQUAL(status, status_server_down)) {
 948                 TALLOC_FREE(dom->private_data);
 949                 status = idmap_ad_sids_to_unixids(dom, ids);
 950         }
 951
 952         return status;
 953 }
 954
 955 static struct idmap_methods ad_methods = {
 956         .init            = idmap_ad_initialize,
 957         .unixids_to_sids = idmap_ad_unixids_to_sids_retry,
 958         .sids_to_unixids = idmap_ad_sids_to_unixids_retry,
 959 };
 960
 961 static_decl_idmap;
 962 NTSTATUS idmap_ad_init(TALLOC_CTX *ctx)
 963 {
 964         NTSTATUS status;
 965
 966         status = smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION,
 967                                     "ad", &ad_methods);
 968         if (!NT_STATUS_IS_OK(status)) {
 969                 return status;
 970         }
 971
 972         status = idmap_ad_nss_init(ctx);
 973         if (!NT_STATUS_IS_OK(status)) {
 974                 return status;
 975         }
 976
 977         return NT_STATUS_OK;
 978 }