2 * idmap_adex: Support for D Forests
4 * Copyright (C) Gerald (Jerry) Carter 2006-2008
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22 #include "idmap_adex.h"
25 #define DBGC_CLASS DBGC_IDMAP
27 #define WINBIND_CCACHE_NAME "MEMORY:winbind_ccache"
29 NTSTATUS
init_module(void);
35 /********************************************************************
36 Basic init function responsible for determining our current mode
37 (standalone or using Centeris Cells). This must return success or
38 it will be dropped from the idmap backend list.
39 *******************************************************************/
41 static NTSTATUS
_idmap_adex_init(struct idmap_domain
*dom
,
44 ADS_STRUCT
*ads
= NULL
;
46 static NTSTATUS init_status
= NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
;
49 struct sockaddr_storage ip
;
50 struct likewise_cell
*lwcell
;
52 if (NT_STATUS_IS_OK(init_status
))
55 /* Silently fail if we are not a member server in security = ads */
57 if ((lp_server_role() != ROLE_DOMAIN_MEMBER
) ||
58 (lp_security() != SEC_ADS
)) {
59 init_status
= NT_STATUS_INVALID_SERVER_STATE
;
60 BAIL_ON_NTSTATUS_ERROR(init_status
);
63 /* fetch our domain SID first */
65 if (!secrets_fetch_domain_sid(lp_workgroup(), &domain_sid
)) {
66 init_status
= NT_STATUS_CANT_ACCESS_DOMAIN_INFO
;
67 BAIL_ON_NTSTATUS_ERROR(init_status
);
70 /* reuse the same ticket cache as winbindd */
72 setenv("KRB5CCNAME", WINBIND_CCACHE_NAME
, 1);
74 /* Establish a connection to a DC */
76 if ((ads
= ads_init(lp_realm(), lp_workgroup(), NULL
)) == NULL
) {
77 init_status
= NT_STATUS_NO_MEMORY
;
78 BAIL_ON_NTSTATUS_ERROR(init_status
);
82 secrets_fetch_machine_password(lp_workgroup(), NULL
, NULL
);
83 ads
->auth
.realm
= SMB_STRDUP(lp_realm());
85 /* get the DC name here to setup the server affinity cache and
88 get_dc_name(lp_workgroup(), lp_realm(), dcname
, &ip
);
90 status
= ads_connect(ads
);
91 if (!ADS_ERR_OK(status
)) {
92 DEBUG(0, ("_idmap_adex_init: ads_connect() failed! (%s)\n",
95 init_status
= ads_ntstatus(status
);
96 BAIL_ON_NTSTATUS_ERROR(init_status
);
99 /* Find out cell membership */
101 init_status
= cell_locate_membership(ads
);
102 if (!NT_STATUS_IS_OK(init_status
)) {
103 DEBUG(0,("LWI: Fail to locate cell membership (%s).",
104 nt_errstr(init_status
)));
108 /* Fill in the cell information */
110 lwcell
= cell_list_head();
112 init_status
= cell_lookup_settings(lwcell
);
113 BAIL_ON_NTSTATUS_ERROR(init_status
);
115 /* Miscellaneous setup. E.g. set up the list of GC
116 servers and domain list for our forest (does not actually
119 init_status
= gc_init_list();
120 BAIL_ON_NTSTATUS_ERROR(init_status
);
122 init_status
= domain_init_list();
123 BAIL_ON_NTSTATUS_ERROR(init_status
);
126 if (!NT_STATUS_IS_OK(init_status
)) {
127 DEBUG(1,("Likewise initialization failed (%s)\n",
128 nt_errstr(init_status
)));
133 if (!NT_STATUS_IS_OK(init_status
)) {
136 /* init_status stores the failure reason but we need to
137 return success or else idmap_init() will drop us from the
142 init_status
= NT_STATUS_OK
;
147 /**********************************************************************
148 *********************************************************************/
150 static NTSTATUS
_idmap_adex_get_sid_from_id(struct
157 bool one_mapped
= false;
158 bool all_mapped
= true;
160 struct likewise_cell
*cell
;
162 nt_status
= _idmap_adex_init(dom
, NULL
);
163 if (!NT_STATUS_IS_OK(nt_status
))
166 if ((cell
= cell_list_head()) == NULL
) {
167 return NT_STATUS_INVALID_SERVER_STATE
;
170 /* have to work through these one by one */
171 for (i
= 0; ids
[i
]; i
++) {
173 status
= cell
->provider
->get_sid_from_id(ids
[i
]->sid
,
176 /* Fail if we cannot find any DC */
178 (status
, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
)) {
182 if (!NT_STATUS_IS_OK(status
)) {
183 ids
[i
]->status
= ID_UNMAPPED
;
188 ids
[i
]->status
= ID_MAPPED
;
195 /**********************************************************************
196 *********************************************************************/
198 static NTSTATUS
_idmap_adex_get_id_from_sid(struct
205 bool one_mapped
= false;
206 bool all_mapped
= true;
208 struct likewise_cell
*cell
;
210 nt_status
= _idmap_adex_init(dom
, NULL
);
211 if (!NT_STATUS_IS_OK(nt_status
))
214 if ((cell
= cell_list_head()) == NULL
) {
215 return NT_STATUS_INVALID_SERVER_STATE
;
218 /* have to work through these one by one */
219 for (i
= 0; ids
[i
]; i
++) {
221 status
= cell
->provider
->get_id_from_sid(&ids
[i
]->xid
.id
,
224 /* Fail if we cannot find any DC */
226 (status
, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
)) {
230 if (!NT_STATUS_IS_OK(status
)) {
231 ids
[i
]->status
= ID_UNMAPPED
;
236 ids
[i
]->status
= ID_MAPPED
;
243 /**********************************************************************
244 *********************************************************************/
246 static NTSTATUS
_idmap_adex_set_mapping(struct
251 DEBUG(0, ("_idmap_adex_set_mapping: not implemented\n"));
252 return NT_STATUS_NOT_IMPLEMENTED
;
255 /**********************************************************************
256 *********************************************************************/
258 static NTSTATUS
_idmap_adex_remove_mapping(struct
265 DEBUG(0, ("_idmap_adex_remove_mapping: not implemented\n"));
266 return NT_STATUS_NOT_IMPLEMENTED
;
269 /**********************************************************************
270 *********************************************************************/
272 static NTSTATUS
_idmap_adex_dump(struct idmap_domain
273 *dom
, struct id_map
**maps
, int *num_map
)
275 return NT_STATUS_NOT_IMPLEMENTED
;
278 /**********************************************************************
279 *********************************************************************/
281 static NTSTATUS
_idmap_adex_close(struct idmap_domain
284 /* FIXME! need to do cleanup here */
293 /**********************************************************************
294 *********************************************************************/
296 static NTSTATUS
_nss_adex_init(struct nss_domain_entry
299 return _idmap_adex_init(NULL
, NULL
);
302 /**********************************************************************
303 *********************************************************************/
305 static NTSTATUS
_nss_adex_get_info(struct
312 char **shell
, char **gecos
, gid_t
* p_gid
)
315 struct likewise_cell
*cell
;
317 nt_status
= _idmap_adex_init(NULL
, NULL
);
318 if (!NT_STATUS_IS_OK(nt_status
))
321 if ((cell
= cell_list_head()) == NULL
) {
322 return NT_STATUS_INVALID_SERVER_STATE
;
325 return cell
->provider
->get_nss_info(sid
, ctx
, homedir
,
326 shell
, gecos
, p_gid
);
329 /**********************************************************************
330 *********************************************************************/
332 static NTSTATUS
_nss_adex_map_to_alias(TALLOC_CTX
* mem_ctx
, const char
336 NTSTATUS nt_status
= NT_STATUS_UNSUCCESSFUL
;
337 struct likewise_cell
*cell
= NULL
;
339 nt_status
= _idmap_adex_init(NULL
, NULL
);
340 BAIL_ON_NTSTATUS_ERROR(nt_status
);
342 if ((cell
= cell_list_head()) == NULL
) {
343 nt_status
= NT_STATUS_INVALID_SERVER_STATE
;
344 BAIL_ON_NTSTATUS_ERROR(nt_status
);
347 nt_status
= cell
->provider
->map_to_alias(mem_ctx
, domain
,
350 /* go ahead and allow the cache mgr to mark this in
353 if (!NT_STATUS_IS_OK(nt_status
))
354 nt_status
= NT_STATUS_NONE_MAPPED
;
360 /**********************************************************************
361 *********************************************************************/
363 static NTSTATUS
_nss_adex_map_from_alias(TALLOC_CTX
* mem_ctx
, const char
367 NTSTATUS nt_status
= NT_STATUS_UNSUCCESSFUL
;
368 struct likewise_cell
*cell
= NULL
;
370 nt_status
= _idmap_adex_init(NULL
, NULL
);
371 BAIL_ON_NTSTATUS_ERROR(nt_status
);
373 if ((cell
= cell_list_head()) == NULL
) {
374 nt_status
= NT_STATUS_INVALID_SERVER_STATE
;
375 BAIL_ON_NTSTATUS_ERROR(nt_status
);
379 nt_status
= cell
->provider
->map_from_alias(mem_ctx
, domain
,
382 /* go ahead and allow the cache mgr to mark this in
385 if (!NT_STATUS_IS_OK(nt_status
))
386 nt_status
= NT_STATUS_NONE_MAPPED
;
392 /**********************************************************************
393 *********************************************************************/
395 static NTSTATUS
_nss_adex_close(void)
397 return NT_STATUS_NOT_IMPLEMENTED
;
400 /**********************************************************************
401 *********************************************************************/
403 static struct idmap_methods adex_idmap_methods
= {
405 .init
= _idmap_adex_init
,
406 .unixids_to_sids
= _idmap_adex_get_sid_from_id
,
407 .sids_to_unixids
= _idmap_adex_get_id_from_sid
,
408 .set_mapping
= _idmap_adex_set_mapping
,
409 .remove_mapping
= _idmap_adex_remove_mapping
,
410 .dump_data
= _idmap_adex_dump
,
411 .close_fn
= _idmap_adex_close
413 static struct nss_info_methods adex_nss_methods
= {
414 .init
= _nss_adex_init
,
415 .get_nss_info
= _nss_adex_get_info
,
416 .map_to_alias
= _nss_adex_map_to_alias
,
417 .map_from_alias
= _nss_adex_map_from_alias
,
418 .close_fn
= _nss_adex_close
421 /**********************************************************************
422 Register with the idmap and idmap_nss subsystems. We have to protect
423 against the idmap and nss_info interfaces being in a half-registered
425 **********************************************************************/
426 NTSTATUS
idmap_adex_init(void)
428 static NTSTATUS idmap_status
= NT_STATUS_UNSUCCESSFUL
;
429 static NTSTATUS nss_status
= NT_STATUS_UNSUCCESSFUL
;
430 if (!NT_STATUS_IS_OK(idmap_status
)) {
432 smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION
,
433 "adex", &adex_idmap_methods
);
434 if (!NT_STATUS_IS_OK(idmap_status
)) {
436 ("idmap_centeris_init: Failed to register the adex"
442 if (!NT_STATUS_IS_OK(nss_status
)) {
444 smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION
,
445 "adex", &adex_nss_methods
);
446 if (!NT_STATUS_IS_OK(nss_status
)) {
448 ("idmap_adex_init: Failed to register the adex"
457 NTSTATUS
nss_info_adex_init(void)
459 return idmap_adex_init();