source3/winbindd/idmap_autorid.c

   1 /*
   2  *  idmap_autorid: static map between Active Directory/NT RIDs
   3  *  and RFC 2307 accounts
   4  *
   5  *  based on the idmap_rid module, but this module defines the ranges
   6  *  for the domains by automatically allocating a range for each domain
   7  *
   8  *  Copyright (C) Christian Ambach, 2010-2012
   9  *
  10  *  This program is free software; you can redistribute it and/or modify
  11  *  it under the terms of the GNU General Public License as published by
  12  *  the Free Software Foundation; either version 3 of the License, or
  13  *  (at your option) any later version.
  14  *
  15  *  This program is distributed in the hope that it will be useful,
  16  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  *  GNU General Public License for more details.
  19  *
  20  *  You should have received a copy of the GNU General Public License
  21  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  22  *
  23  */
  24
  25 /*
  26  * This module allocates ranges for domains to be used in a
  27  * algorithmic mode like idmap_rid. Multiple ranges are supported
  28  * for a single domain: If a rid exceeds the range size, a matching
  29  * range is allocated to hold the rid's id.
  30  *
  31  * Here are the formulas applied:
  32  *
  33  *
  34  * For a sid of the form domain_sid-rid, we have
  35  *
  36  *   rid = reduced_rid + domain_range_index * range_size
  37  *
  38  * with
  39  *   reduced_rid := rid % range_size
  40  *   domain_range_index := rid / range_size
  41  *
  42  * And reduced_rid fits into a range.
  43  *
  44  * In the database, we associate a range_number to
  45  * the pair domain_sid,domain_range_index.
  46  *
  47  * Now the unix id for the given sid calculates as:
  48  *
  49  *   id = reduced_rid + range_low_id
  50  *
  51  * with
  52  *
  53  *   range_low_id = low_id + range_number * range_size
  54  *
  55  *
  56  * The inverse calculation goes like this:
  57  *
  58  * Given a unix id, let
  59  *
  60  *   normalized_id := id - low_id
  61  *   reduced_rid := normalized_id % range_size
  62  *   range_number = normalized_id / range_size
  63  *
  64  * Then we have
  65  *
  66  *   id = reduced_rid + low_id + range_number * range_size
  67  *
  68  * From the database, get the domain_sid,domain_range_index pair
  69  * belonging to the range_number (if there is already one).
  70  *
  71  * Then the rid for the unix id calculates as:
  72  *
  73  *   rid = reduced_rid + domain_range_index * range_size
  74  */
  75
  76 #include "idmap_autorid_tdb.h"
  77 #include "winbindd.h"
  78 #include "idmap.h"
  79 #include "idmap_rw.h"
  80 #include "../libcli/security/dom_sid.h"
  81
  82 #undef DBGC_CLASS
  83 #define DBGC_CLASS DBGC_IDMAP
  84
  85 /* handle to the tdb storing domain <-> range assignments */
  86 static struct db_context *autorid_db;
  87
  88 static bool ignore_builtin = false;
  89
  90 static NTSTATUS idmap_autorid_get_alloc_range(struct idmap_domain *dom,
  91                                         struct autorid_range_config *range)
  92 {
  93         NTSTATUS status;
  94
  95         ZERO_STRUCT(*range);
  96
  97         fstrcpy(range->domsid, ALLOC_RANGE);
  98
  99         status = idmap_autorid_get_domainrange(autorid_db,
 100                                                range,
 101                                                dom->read_only);
 102
 103         return status;
 104 }
 105
 106 static NTSTATUS idmap_autorid_allocate_id(struct idmap_domain *dom,
 107                                           struct unixid *xid) {
 108
 109         NTSTATUS ret;
 110         struct autorid_range_config range;
 111
 112         if (dom->read_only) {
 113                 DEBUG(3, ("Backend is read-only, refusing "
 114                           "new allocation request\n"));
 115                 return NT_STATUS_UNSUCCESSFUL;
 116         }
 117
 118         /* fetch the range for the allocation pool */
 119
 120         ret = idmap_autorid_get_alloc_range(dom, &range);
 121         if (!NT_STATUS_IS_OK(ret)) {
 122                 DEBUG(3, ("Could not determine range for allocation pool, "
 123                           "check previous messages for reason\n"));
 124                 return ret;
 125         }
 126
 127         ret = idmap_tdb_common_get_new_id(dom, xid);
 128
 129         if (!NT_STATUS_IS_OK(ret)) {
 130                 DEBUG(1, ("Fatal error while allocating new ID!\n"));
 131                 return ret;
 132         }
 133
 134         xid->id = xid->id + range.low_id;
 135
 136         DEBUG(10, ("Returned new %s %d from allocation range\n",
 137                    (xid->type==ID_TYPE_UID)?"uid":"gid", xid->id));
 138
 139         return ret;
 140 }
 141
 142 /*
 143  * map a SID to xid using the idmap_tdb like pool
 144  */
 145 static NTSTATUS idmap_autorid_id_to_sid_alloc(struct idmap_domain *dom,
 146                                               struct id_map *map)
 147 {
 148         NTSTATUS ret;
 149
 150         /* look out for the mapping */
 151         ret = idmap_tdb_common_unixid_to_sid(dom, map);
 152
 153         if (NT_STATUS_IS_OK(ret)) {
 154                 map->status = ID_MAPPED;
 155                 return ret;
 156         }
 157
 158         map->status = ID_UNKNOWN;
 159
 160         DEBUG(10, ("no ID->SID mapping for %d could be found\n", map->xid.id));
 161
 162         return ret;
 163 }
 164
 165 static NTSTATUS idmap_autorid_id_to_sid(struct autorid_global_config *cfg,
 166                                         struct idmap_domain *dom,
 167                                         struct id_map *map)
 168 {
 169         uint32_t range_number;
 170         uint32_t domain_range_index = 0;
 171         uint32_t normalized_id;
 172         uint32_t reduced_rid;
 173         uint32_t rid;
 174         TDB_DATA data = tdb_null;
 175         char *keystr;
 176         struct dom_sid domsid;
 177         NTSTATUS status;
 178         bool ok;
 179         const char *q = NULL;
 180
 181         /* can this be one of our ids? */
 182         if (map->xid.id < cfg->minvalue) {
 183                 DEBUG(10, ("id %d is lower than minimum value, "
 184                            "ignoring mapping request\n", map->xid.id));
 185                 map->status = ID_UNKNOWN;
 186                 return NT_STATUS_OK;
 187         }
 188
 189         if (map->xid.id > (cfg->minvalue + cfg->rangesize * cfg->maxranges)) {
 190                 DEBUG(10, ("id %d is outside of maximum id value, "
 191                            "ignoring mapping request\n", map->xid.id));
 192                 map->status = ID_UNKNOWN;
 193                 return NT_STATUS_OK;
 194         }
 195
 196         /* determine the range of this uid */
 197
 198         normalized_id = map->xid.id - cfg->minvalue;
 199         range_number = normalized_id / cfg->rangesize;
 200
 201         keystr = talloc_asprintf(talloc_tos(), "%u", range_number);
 202         if (!keystr) {
 203                 return NT_STATUS_NO_MEMORY;
 204         }
 205
 206         status = dbwrap_fetch_bystring(autorid_db, talloc_tos(), keystr, &data);
 207         TALLOC_FREE(keystr);
 208
 209         if (!NT_STATUS_IS_OK(status)) {
 210                 DEBUG(4, ("id %d belongs to range %d which does not have "
 211                           "domain mapping, ignoring mapping request\n",
 212                           map->xid.id, range_number));
 213                 TALLOC_FREE(data.dptr);
 214                 map->status = ID_UNKNOWN;
 215                 return NT_STATUS_OK;
 216         }
 217
 218         if (strncmp((const char *)data.dptr,
 219                     ALLOC_RANGE,
 220                     strlen(ALLOC_RANGE)) == 0) {
 221                 /*
 222                  * this is from the alloc range, check if there is a mapping
 223                  */
 224                 DEBUG(5, ("id %d belongs to allocation range, "
 225                           "checking for mapping\n",
 226                           map->xid.id));
 227                 TALLOC_FREE(data.dptr);
 228                 return idmap_autorid_id_to_sid_alloc(dom, map);
 229         }
 230
 231         ok = dom_sid_parse_endp((const char *)data.dptr, &domsid, &q);
 232         TALLOC_FREE(data.dptr);
 233         if (!ok) {
 234                 map->status = ID_UNKNOWN;
 235                 return NT_STATUS_OK;
 236         }
 237         if ((q != NULL) && (*q != '\0'))
 238                 if (sscanf(q+1, "%"SCNu32, &domain_range_index) != 1) {
 239                         DEBUG(10, ("Domain range index not found, "
 240                                    "ignoring mapping request\n"));
 241                         map->status = ID_UNKNOWN;
 242                         return NT_STATUS_OK;
 243                 }
 244
 245         reduced_rid = normalized_id % cfg->rangesize;
 246         rid = reduced_rid + domain_range_index * cfg->rangesize;
 247
 248         sid_compose(map->sid, &domsid, rid);
 249
 250         /* We **really** should have some way of validating
 251            the SID exists and is the correct type here.  But
 252            that is a deficiency in the idmap_rid design. */
 253
 254         map->status = ID_MAPPED;
 255         map->xid.type = ID_TYPE_BOTH;
 256
 257         return NT_STATUS_OK;
 258 }
 259
 260 /**********************************
 261  Single sid to id lookup function.
 262 **********************************/
 263
 264 static NTSTATUS idmap_autorid_sid_to_id(struct autorid_global_config *global,
 265                                         struct autorid_range_config *range,
 266                                         struct id_map *map)
 267 {
 268         uint32_t rid;
 269         uint32_t reduced_rid;
 270
 271         sid_peek_rid(map->sid, &rid);
 272
 273         reduced_rid = rid % global->rangesize;
 274
 275         map->xid.id = reduced_rid + range->low_id;
 276         map->xid.type = ID_TYPE_BOTH;
 277         map->status = ID_MAPPED;
 278
 279         return NT_STATUS_OK;
 280 }
 281
 282 /**********************************
 283  lookup a set of unix ids.
 284 **********************************/
 285
 286 static NTSTATUS idmap_autorid_unixids_to_sids(struct idmap_domain *dom,
 287                                               struct id_map **ids)
 288 {
 289         struct idmap_tdb_common_context *commoncfg;
 290         struct autorid_global_config *globalcfg;
 291         NTSTATUS ret;
 292         int i;
 293         int num_tomap = 0;
 294         int num_mapped = 0;
 295
 296         /* initialize the status to avoid surprise */
 297         for (i = 0; ids[i]; i++) {
 298                 ids[i]->status = ID_UNKNOWN;
 299                 num_tomap++;
 300         }
 301
 302         commoncfg =
 303             talloc_get_type_abort(dom->private_data,
 304                                   struct idmap_tdb_common_context);
 305
 306         globalcfg = talloc_get_type(commoncfg->private_data,
 307                                     struct autorid_global_config);
 308
 309         for (i = 0; ids[i]; i++) {
 310
 311                 ret = idmap_autorid_id_to_sid(globalcfg, dom, ids[i]);
 312
 313                 if ((!NT_STATUS_IS_OK(ret)) &&
 314                     (!NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED))) {
 315                         /* some fatal error occurred, log it */
 316                         DEBUG(3, ("Unexpected error resolving an ID "
 317                                   " (%d)\n", ids[i]->xid.id));
 318                         goto failure;
 319                 }
 320
 321                 if (NT_STATUS_IS_OK(ret) && ids[i]->status == ID_MAPPED) {
 322                         num_mapped++;
 323                 }
 324
 325         }
 326
 327         if (num_tomap == num_mapped) {
 328                 return NT_STATUS_OK;
 329         } else if (num_mapped == 0) {
 330                 return NT_STATUS_NONE_MAPPED;
 331         }
 332
 333         return STATUS_SOME_UNMAPPED;
 334
 335
 336       failure:
 337         return ret;
 338 }
 339
 340 /*
 341  * map a SID to xid using the idmap_tdb like pool
 342  */
 343 static NTSTATUS idmap_autorid_sid_to_id_alloc(struct idmap_domain *dom,
 344                                         struct id_map *map,
 345                                         struct idmap_tdb_common_context *ctx)
 346 {
 347         NTSTATUS ret;
 348         int res;
 349
 350         /* see if we already have a mapping */
 351         ret = idmap_tdb_common_sid_to_unixid(dom, map);
 352
 353         if (NT_STATUS_IS_OK(ret)) {
 354                 map->status = ID_MAPPED;
 355                 return ret;
 356         }
 357
 358         /* bad things happened */
 359         if (!NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED)) {
 360                 DEBUG(1, ("Looking up SID->ID mapping for %s failed: %s\n",
 361                           sid_string_dbg(map->sid), nt_errstr(ret)));
 362                 return ret;
 363         }
 364
 365         if (dom->read_only) {
 366                 DEBUG(3, ("Not allocating new mapping for %s, because backend "
 367                           "is read-only\n", sid_string_dbg(map->sid)));
 368                 return NT_STATUS_NONE_MAPPED;
 369         }
 370
 371         DEBUG(10, ("Creating new mapping in pool for %s\n",
 372                    sid_string_dbg(map->sid)));
 373
 374         /* create new mapping */
 375         res = dbwrap_transaction_start(ctx->db);
 376         if (res != 0) {
 377                 DEBUG(2, ("transaction_start failed\n"));
 378                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 379         }
 380
 381         ret = idmap_tdb_common_new_mapping(dom, map);
 382
 383         map->status = (NT_STATUS_IS_OK(ret))?ID_MAPPED:ID_UNMAPPED;
 384
 385         if (!NT_STATUS_IS_OK(ret)) {
 386                 if (dbwrap_transaction_cancel(ctx->db) != 0) {
 387                         smb_panic("Cancelling transaction failed");
 388                 }
 389                 return ret;
 390         }
 391
 392         res = dbwrap_transaction_commit(ctx->db);
 393         if (res == 0) {
 394                 return ret;
 395         }
 396
 397         DEBUG(2, ("transaction_commit failed\n"));
 398         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 399
 400 }
 401
 402 /**********************************
 403  lookup a set of sids.
 404 **********************************/
 405
 406 static NTSTATUS idmap_autorid_sids_to_unixids(struct idmap_domain *dom,
 407                                               struct id_map **ids)
 408 {
 409         struct idmap_tdb_common_context *commoncfg;
 410         struct autorid_global_config *global;
 411         NTSTATUS ret;
 412         int i;
 413         int num_tomap = 0;
 414         int num_mapped = 0;
 415
 416         /* initialize the status to avoid surprise */
 417         for (i = 0; ids[i]; i++) {
 418                 ids[i]->status = ID_UNKNOWN;
 419                 num_tomap++;
 420         }
 421
 422         commoncfg =
 423             talloc_get_type_abort(dom->private_data,
 424                                   struct idmap_tdb_common_context);
 425
 426         global = talloc_get_type(commoncfg->private_data,
 427                                  struct autorid_global_config);
 428
 429         for (i = 0; ids[i]; i++) {
 430                 struct winbindd_tdc_domain *domain;
 431                 struct autorid_range_config range;
 432                 uint32_t rid;
 433                 struct dom_sid domainsid;
 434
 435                 ZERO_STRUCT(range);
 436
 437                 DEBUG(10, ("Trying to map %s\n", sid_string_dbg(ids[i]->sid)));
 438
 439                 sid_copy(&domainsid, ids[i]->sid);
 440                 if (!sid_split_rid(&domainsid, &rid)) {
 441                         DEBUG(4, ("Could not determine domain SID from %s, "
 442                                   "ignoring mapping request\n",
 443                                   sid_string_dbg(ids[i]->sid)));
 444                         continue;
 445                 }
 446
 447                 /* is this a well-known SID? */
 448
 449                 if (sid_check_is_wellknown_domain(&domainsid, NULL)) {
 450
 451                         DEBUG(10, ("SID %s is well-known, using pool\n",
 452                                    sid_string_dbg(ids[i]->sid)));
 453
 454                         ret = idmap_autorid_sid_to_id_alloc(dom, ids[i],
 455                                                             commoncfg);
 456
 457                         if (!NT_STATUS_IS_OK(ret) &&
 458                             !NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED)) {
 459                                 DEBUG(3, ("Unexpected error resolving "
 460                                           "SID (%s)\n",
 461                                           sid_string_dbg(ids[i]->sid)));
 462                                 goto failure;
 463                         }
 464
 465                         if (ids[i]->status == ID_MAPPED) {
 466                                 num_mapped++;
 467                         }
 468
 469                         continue;
 470                 }
 471
 472                 /* BUILTIN is passdb's job */
 473                 if (dom_sid_equal(&domainsid, &global_sid_Builtin) &&
 474                     ignore_builtin) {
 475                         DEBUG(10, ("Ignoring request for BUILTIN domain\n"));
 476                         continue;
 477                 }
 478
 479                 /*
 480                  * Check if the domain is around
 481                  */
 482                 domain = wcache_tdc_fetch_domainbysid(talloc_tos(),
 483                                                       &domainsid);
 484                 if (domain == NULL) {
 485                         DEBUG(10, ("Ignoring unknown domain sid %s\n",
 486                                    sid_string_dbg(&domainsid)));
 487                         continue;
 488                 }
 489                 TALLOC_FREE(domain);
 490
 491                 sid_to_fstring(range.domsid, &domainsid);
 492
 493                 /* Calculate domain_range_index for multi-range support */
 494                 range.domain_range_index = rid / (global->rangesize);
 495
 496                 ret = idmap_autorid_get_domainrange(autorid_db, &range,
 497                                                     dom->read_only);
 498
 499                 /* read-only mode and a new domain range would be required? */
 500                 if (NT_STATUS_EQUAL(ret, NT_STATUS_NOT_FOUND) &&
 501                     dom->read_only) {
 502                         DEBUG(10, ("read-only is enabled, did not allocate "
 503                                    "new range for domain %s\n",
 504                                    sid_string_dbg(&domainsid)));
 505                         continue;
 506                 }
 507
 508                 if (!NT_STATUS_IS_OK(ret)) {
 509                         DEBUG(3, ("Could not determine range for domain, "
 510                                   "check previous messages for reason\n"));
 511                         goto failure;
 512                 }
 513
 514                 ret = idmap_autorid_sid_to_id(global, &range, ids[i]);
 515
 516                 if ((!NT_STATUS_IS_OK(ret)) &&
 517                     (!NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED))) {
 518                         /* some fatal error occurred, log it */
 519                         DEBUG(3, ("Unexpected error resolving a SID (%s)\n",
 520                                   sid_string_dbg(ids[i]->sid)));
 521                         goto failure;
 522                 }
 523
 524                 if (NT_STATUS_IS_OK(ret)) {
 525                         num_mapped++;
 526                 }
 527         }
 528
 529         if (num_tomap == num_mapped) {
 530                 return NT_STATUS_OK;
 531         } else if (num_mapped == 0) {
 532                 return NT_STATUS_NONE_MAPPED;
 533         }
 534
 535         return STATUS_SOME_UNMAPPED;
 536
 537       failure:
 538         return ret;
 539
 540 }
 541
 542 static NTSTATUS idmap_autorid_preallocate_wellknown(struct idmap_domain *dom)
 543 {
 544         const char *groups[] = { "S-1-1-0", "S-1-2-0", "S-1-2-1",
 545                 "S-1-3-0", "S-1-3-1", "S-1-3-2", "S-1-3-3", "S-1-3-4",
 546                 "S-1-5-1", "S-1-5-2", "S-1-5-3", "S-1-5-4", "S-1-5-6",
 547                 "S-1-5-7", "S-1-5-8", "S-1-5-9", "S-1-5-10", "S-1-5-11",
 548                 "S-1-5-12", "S-1-5-13", "S-1-5-14", "S-1-5-15",
 549                 "S-1-5-17", "S-1-5-18", "S-1-5-19", "S-1-5-20"
 550         };
 551
 552         struct id_map **maps;
 553         int i, num;
 554         NTSTATUS status;
 555
 556         if (dom->read_only) {
 557                 return NT_STATUS_OK;
 558         }
 559
 560         num = ARRAY_SIZE(groups);
 561
 562         maps = talloc_array(talloc_tos(), struct id_map*, num+1);
 563         if (!maps) {
 564                 return NT_STATUS_NO_MEMORY;
 565         }
 566
 567         for (i = 0; i < num; i++) {
 568                 maps[i] = talloc(maps, struct id_map);
 569                 if (maps[i] == NULL) {
 570                         talloc_free(maps);
 571                         return NT_STATUS_NO_MEMORY;
 572                 }
 573                 maps[i]->xid.type = ID_TYPE_GID;
 574                 maps[i]->sid = dom_sid_parse_talloc(maps, groups[i]);
 575         }
 576
 577         maps[num] = NULL;
 578
 579         status = idmap_autorid_sids_to_unixids(dom, maps);
 580
 581         DEBUG(10,("Preallocation run finished with status %s\n",
 582                   nt_errstr(status)));
 583
 584         talloc_free(maps);
 585
 586         return NT_STATUS_IS_OK(status)?NT_STATUS_OK:NT_STATUS_UNSUCCESSFUL;
 587 }
 588
 589 static NTSTATUS idmap_autorid_initialize_action(struct db_context *db,
 590                                                 void *private_data)
 591 {
 592         struct idmap_domain *dom;
 593         struct idmap_tdb_common_context *common;
 594         struct autorid_global_config *config;
 595         NTSTATUS status;
 596
 597         dom = (struct idmap_domain *)private_data;
 598         common = (struct idmap_tdb_common_context *)dom->private_data;
 599         config = (struct autorid_global_config *)common->private_data;
 600
 601         status = idmap_autorid_init_hwms(db);
 602         if (!NT_STATUS_IS_OK(status)) {
 603                 return status;
 604         }
 605
 606         status = idmap_autorid_saveconfig(db, config);
 607         if (!NT_STATUS_IS_OK(status)) {
 608                 DEBUG(1, ("Failed to store configuration data!\n"));
 609                 return status;
 610         }
 611
 612         status = idmap_autorid_preallocate_wellknown(dom);
 613         if (!NT_STATUS_IS_OK(status)) {
 614                 DEBUG(1, ("Failed to preallocate wellknown sids: %s\n",
 615                           nt_errstr(status)));
 616                 return status;
 617         }
 618
 619         return NT_STATUS_OK;
 620 }
 621
 622 static NTSTATUS idmap_autorid_initialize(struct idmap_domain *dom)
 623 {
 624         struct idmap_tdb_common_context *commonconfig;
 625         struct autorid_global_config *config;
 626         NTSTATUS status;
 627
 628         if (!strequal(dom->name, "*")) {
 629                 DEBUG(0, ("idmap_autorid_initialize: Error: autorid configured "
 630                           "for domain '%s'. But autorid can only be used for "
 631                           "the default idmap configuration.\n", dom->name));
 632                 return NT_STATUS_INVALID_PARAMETER;
 633         }
 634
 635         commonconfig = talloc_zero(dom, struct idmap_tdb_common_context);
 636         if (!commonconfig) {
 637                 DEBUG(0, ("Out of memory!\n"));
 638                 return NT_STATUS_NO_MEMORY;
 639         }
 640         dom->private_data = commonconfig;
 641
 642         commonconfig->rw_ops = talloc_zero(commonconfig, struct idmap_rw_ops);
 643         if (commonconfig->rw_ops == NULL) {
 644                 DEBUG(0, ("Out of memory!\n"));
 645                 return NT_STATUS_NO_MEMORY;
 646         }
 647
 648         config = talloc_zero(commonconfig, struct autorid_global_config);
 649         if (!config) {
 650                 DEBUG(0, ("Out of memory!\n"));
 651                 return NT_STATUS_NO_MEMORY;
 652         }
 653         commonconfig->private_data = config;
 654
 655         config->minvalue = dom->low_id;
 656         config->rangesize = lp_parm_int(-1, "idmap config *",
 657                                         "rangesize", 100000);
 658
 659         config->maxranges = (dom->high_id - dom->low_id + 1) /
 660             config->rangesize;
 661
 662         if (config->maxranges == 0) {
 663                 DEBUG(1, ("Allowed uid range is smaller than rangesize. "
 664                           "Increase uid range or decrease rangesize.\n"));
 665                 status = NT_STATUS_INVALID_PARAMETER;
 666                 goto error;
 667         }
 668
 669         /* check if the high-low limit is a multiple of the rangesize */
 670         if ((dom->high_id - dom->low_id + 1) % config->rangesize != 0) {
 671                 DEBUG(5, ("High uid-low uid difference of %d "
 672                           "is not a multiple of the rangesize %d, "
 673                           "limiting ranges to lower boundary number of %d\n",
 674                           (dom->high_id - dom->low_id + 1), config->rangesize,
 675                           config->maxranges));
 676         }
 677
 678         DEBUG(5, ("%d domain ranges with a size of %d are available\n",
 679                   config->maxranges, config->rangesize));
 680
 681         ignore_builtin = lp_parm_bool(-1, "idmap config *",
 682                                       "ignore builtin", false);
 683
 684         /* fill the TDB common configuration */
 685
 686         commonconfig->max_id = config->rangesize -1;
 687         commonconfig->hwmkey_uid = ALLOC_HWM_UID;
 688         commonconfig->hwmkey_gid = ALLOC_HWM_GID;
 689         commonconfig->rw_ops->get_new_id = idmap_autorid_allocate_id;
 690         commonconfig->rw_ops->set_mapping = idmap_tdb_common_set_mapping;
 691
 692         status = idmap_autorid_db_open(state_path("autorid.tdb"),
 693                                        NULL, /* TALLOC_CTX */
 694                                        &autorid_db);
 695         if (!NT_STATUS_IS_OK(status)) {
 696                 goto error;
 697         }
 698
 699         commonconfig->db = autorid_db;
 700
 701         status = dbwrap_trans_do(autorid_db,
 702                                  idmap_autorid_initialize_action,
 703                                  dom);
 704         if (!NT_STATUS_IS_OK(status)) {
 705                 DEBUG(1, ("Failed to init the idmap database: %s\n",
 706                           nt_errstr(status)));
 707                 goto error;
 708         }
 709
 710         goto done;
 711
 712 error:
 713         talloc_free(config);
 714
 715 done:
 716         return status;
 717 }
 718
 719 /*
 720   Close the idmap tdb instance
 721 */
 722 static struct idmap_methods autorid_methods = {
 723         .init = idmap_autorid_initialize,
 724         .unixids_to_sids = idmap_autorid_unixids_to_sids,
 725         .sids_to_unixids = idmap_autorid_sids_to_unixids,
 726         .allocate_id     = idmap_autorid_allocate_id
 727 };
 728
 729 NTSTATUS idmap_autorid_init(void)
 730 {
 731         return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION,
 732                                   "autorid", &autorid_methods);
 733 }