2 Unix SMB/CIFS implementation.
3 Password and authentication handling
4 Copyright (C) Andrew Bartlett 2002
5 Copyright (C) Jelmer Vernooij 2002
6 Copyright (C) Simo Sorce 2003
7 Copyright (C) Volker Lendecke 2006
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
27 #define DBGC_CLASS DBGC_PASSDB
29 /* Cache of latest SAM lookup query */
31 static struct samu
*csamuser
= NULL
;
35 static struct pdb_init_function_entry
*backends
= NULL
;
37 static void lazy_initialize_passdb(void)
39 static BOOL initialized
= False
;
40 if(initialized
)return;
45 static BOOL
lookup_global_sam_rid(TALLOC_CTX
*mem_ctx
, uint32 rid
,
47 enum SID_NAME_USE
*psid_name_use
,
48 union unid_t
*unix_id
);
49 /*******************************************************************
50 Clean up uninitialised passwords. The only way to tell
51 that these values are not 'real' is that they do not
52 have a valid last set time. Instead, the value is fixed at 0.
53 Therefore we use that as the key for 'is this a valid password'.
54 However, it is perfectly valid to have a 'default' last change
55 time, such LDAP with a missing attribute would produce.
56 ********************************************************************/
58 static void pdb_force_pw_initialization(struct samu
*pass
)
60 const uint8
*lm_pwd
, *nt_pwd
;
62 /* only reset a password if the last set time has been
63 explicitly been set to zero. A default last set time
66 if ( (pdb_get_init_flags(pass
, PDB_PASSLASTSET
) != PDB_DEFAULT
)
67 && (pdb_get_pass_last_set_time(pass
) == 0) )
70 if (pdb_get_init_flags(pass
, PDB_LMPASSWD
) != PDB_DEFAULT
)
72 lm_pwd
= pdb_get_lanman_passwd(pass
);
74 pdb_set_lanman_passwd(pass
, NULL
, PDB_CHANGED
);
76 if (pdb_get_init_flags(pass
, PDB_NTPASSWD
) != PDB_DEFAULT
)
78 nt_pwd
= pdb_get_nt_passwd(pass
);
80 pdb_set_nt_passwd(pass
, NULL
, PDB_CHANGED
);
87 NTSTATUS
smb_register_passdb(int version
, const char *name
, pdb_init_function init
)
89 struct pdb_init_function_entry
*entry
= backends
;
91 if(version
!= PASSDB_INTERFACE_VERSION
) {
92 DEBUG(0,("Can't register passdb backend!\n"
93 "You tried to register a passdb module with PASSDB_INTERFACE_VERSION %d, "
94 "while this version of samba uses version %d\n",
95 version
,PASSDB_INTERFACE_VERSION
));
96 return NT_STATUS_OBJECT_TYPE_MISMATCH
;
100 return NT_STATUS_INVALID_PARAMETER
;
103 DEBUG(5,("Attempting to register passdb backend %s\n", name
));
105 /* Check for duplicates */
106 if (pdb_find_backend_entry(name
)) {
107 DEBUG(0,("There already is a passdb backend registered with the name %s!\n", name
));
108 return NT_STATUS_OBJECT_NAME_COLLISION
;
111 entry
= SMB_XMALLOC_P(struct pdb_init_function_entry
);
112 entry
->name
= smb_xstrdup(name
);
115 DLIST_ADD(backends
, entry
);
116 DEBUG(5,("Successfully added passdb backend '%s'\n", name
));
120 struct pdb_init_function_entry
*pdb_find_backend_entry(const char *name
)
122 struct pdb_init_function_entry
*entry
= backends
;
125 if (strcmp(entry
->name
, name
)==0) return entry
;
132 /******************************************************************
133 Make a pdb_methods from scratch
134 *******************************************************************/
136 NTSTATUS
make_pdb_method_name(struct pdb_methods
**methods
, const char *selected
)
138 char *module_name
= smb_xstrdup(selected
);
139 char *module_location
= NULL
, *p
;
140 struct pdb_init_function_entry
*entry
;
141 NTSTATUS nt_status
= NT_STATUS_UNSUCCESSFUL
;
143 lazy_initialize_passdb();
145 p
= strchr(module_name
, ':');
149 module_location
= p
+1;
150 trim_char(module_location
, ' ', ' ');
153 trim_char(module_name
, ' ', ' ');
156 DEBUG(5,("Attempting to find an passdb backend to match %s (%s)\n", selected
, module_name
));
158 entry
= pdb_find_backend_entry(module_name
);
160 /* Try to find a module that contains this module */
162 DEBUG(2,("No builtin backend found, trying to load plugin\n"));
163 if(NT_STATUS_IS_OK(smb_probe_module("pdb", module_name
)) && !(entry
= pdb_find_backend_entry(module_name
))) {
164 DEBUG(0,("Plugin is available, but doesn't register passdb backend %s\n", module_name
));
165 SAFE_FREE(module_name
);
166 return NT_STATUS_UNSUCCESSFUL
;
170 /* No such backend found */
172 DEBUG(0,("No builtin nor plugin backend for %s found\n", module_name
));
173 SAFE_FREE(module_name
);
174 return NT_STATUS_INVALID_PARAMETER
;
177 DEBUG(5,("Found pdb backend %s\n", module_name
));
179 if ( !NT_STATUS_IS_OK( nt_status
= entry
->init(methods
, module_location
) ) ) {
180 DEBUG(0,("pdb backend %s did not correctly init (error was %s)\n",
181 selected
, nt_errstr(nt_status
)));
182 SAFE_FREE(module_name
);
186 SAFE_FREE(module_name
);
188 DEBUG(5,("pdb backend %s has a valid init\n", selected
));
193 /******************************************************************
194 Return an already initialised pdn_methods structure
195 *******************************************************************/
197 static struct pdb_methods
*pdb_get_methods_reload( BOOL reload
)
199 static struct pdb_methods
*pdb
= NULL
;
201 if ( pdb
&& reload
) {
202 pdb
->free_private_data( &(pdb
->private_data
) );
203 if ( !NT_STATUS_IS_OK( make_pdb_method_name( &pdb
, lp_passdb_backend() ) ) ) {
209 if ( !NT_STATUS_IS_OK( make_pdb_method_name( &pdb
, lp_passdb_backend() ) ) ) {
217 static struct pdb_methods
*pdb_get_methods(void)
219 return pdb_get_methods_reload(False
);
222 /******************************************************************
223 Backward compatibility functions for the original passdb interface
224 *******************************************************************/
226 BOOL
pdb_setsampwent(BOOL update
, uint16 acb_mask
)
228 struct pdb_methods
*pdb
= pdb_get_methods();
234 return NT_STATUS_IS_OK(pdb
->setsampwent(pdb
, update
, acb_mask
));
237 void pdb_endsampwent(void)
239 struct pdb_methods
*pdb
= pdb_get_methods();
245 pdb
->endsampwent(pdb
);
248 BOOL
pdb_getsampwent(struct samu
*user
)
250 struct pdb_methods
*pdb
= pdb_get_methods();
256 if ( !NT_STATUS_IS_OK(pdb
->getsampwent(pdb
, user
) ) ) {
260 pdb_force_pw_initialization( user
);
265 BOOL
pdb_getsampwnam(struct samu
*sam_acct
, const char *username
)
267 struct pdb_methods
*pdb
= pdb_get_methods();
273 if (!NT_STATUS_IS_OK(pdb
->getsampwnam(pdb
, sam_acct
, username
))) {
278 TALLOC_FREE(csamuser
);
281 pdb_force_pw_initialization( sam_acct
);
283 if ( (csamuser
= samu_new( NULL
)) != NULL
) {
284 pdb_copy_sam_account(csamuser
, sam_acct
);
290 /**********************************************************************
291 **********************************************************************/
293 BOOL
guest_user_info( struct samu
*user
)
297 const char *guestname
= lp_guestaccount();
299 if ( !(pwd
= getpwnam_alloc( NULL
, guestname
) ) ) {
300 DEBUG(0,("guest_user_info: Unable to locate guest account [%s]!\n",
305 result
= samu_set_unix(user
, pwd
);
309 return NT_STATUS_IS_OK( result
);
312 /**********************************************************************
313 **********************************************************************/
315 BOOL
pdb_getsampwsid(struct samu
*sam_acct
, const DOM_SID
*sid
)
317 struct pdb_methods
*pdb
;
320 if ( !(pdb
= pdb_get_methods()) ) {
324 /* hard code the Guest RID of 501 */
326 if ( !sid_peek_check_rid( get_global_sam_sid(), sid
, &rid
) )
329 if ( rid
== DOMAIN_USER_RID_GUEST
) {
330 DEBUG(6,("pdb_getsampwsid: Building guest account\n"));
331 return guest_user_info( sam_acct
);
334 /* check the cache first */
336 if ( csamuser
&& sid_equal(sid
, pdb_get_user_sid(csamuser
) ) )
337 return pdb_copy_sam_account(sam_acct
, csamuser
);
339 return NT_STATUS_IS_OK(pdb
->getsampwsid(pdb
, sam_acct
, sid
));
342 static NTSTATUS
pdb_default_create_user(struct pdb_methods
*methods
,
343 TALLOC_CTX
*tmp_ctx
, const char *name
,
344 uint32 acb_info
, uint32
*rid
)
346 struct samu
*sam_pass
;
350 if ((sam_pass
= samu_new(tmp_ctx
)) == NULL
) {
351 return NT_STATUS_NO_MEMORY
;
354 if ( !(pwd
= Get_Pwnam_alloc(tmp_ctx
, name
)) ) {
358 if ((acb_info
& ACB_NORMAL
) && name
[strlen(name
)-1] != '$') {
359 pstrcpy(add_script
, lp_adduser_script());
361 pstrcpy(add_script
, lp_addmachine_script());
364 if (add_script
[0] == '\0') {
365 DEBUG(3, ("Could not find user %s and no add script "
367 return NT_STATUS_NO_SUCH_USER
;
370 all_string_sub(add_script
, "%u", name
, sizeof(add_script
));
371 add_ret
= smbrun(add_script
,NULL
);
372 DEBUG(add_ret
? 0 : 3, ("_samr_create_user: Running the command `%s' gave %d\n",
373 add_script
, add_ret
));
376 pwd
= Get_Pwnam_alloc(tmp_ctx
, name
);
379 /* we have a valid SID coming out of this call */
381 status
= samu_alloc_rid_unix( sam_pass
, pwd
);
385 if (!NT_STATUS_IS_OK(status
)) {
386 DEBUG(3, ("pdb_default_create_user: failed to create a new user structure: %s\n", nt_errstr(status
)));
390 if (!sid_peek_check_rid(get_global_sam_sid(),
391 pdb_get_user_sid(sam_pass
), rid
)) {
392 DEBUG(0, ("Could not get RID of fresh user\n"));
393 return NT_STATUS_INTERNAL_ERROR
;
396 /* Disable the account on creation, it does not have a reasonable password yet. */
398 acb_info
|= ACB_DISABLED
;
400 pdb_set_acct_ctrl(sam_pass
, acb_info
, PDB_CHANGED
);
402 status
= pdb_add_sam_account(sam_pass
);
404 TALLOC_FREE(sam_pass
);
409 NTSTATUS
pdb_create_user(TALLOC_CTX
*mem_ctx
, const char *name
, uint32 flags
,
412 struct pdb_methods
*pdb
= pdb_get_methods();
415 return NT_STATUS_UNSUCCESSFUL
;
418 return pdb
->create_user(pdb
, mem_ctx
, name
, flags
, rid
);
421 /****************************************************************************
422 Delete a UNIX user on demand.
423 ****************************************************************************/
425 static int smb_delete_user(const char *unix_user
)
432 if ( strequal( unix_user
, "root" ) ) {
433 DEBUG(0,("smb_delete_user: Refusing to delete local system root account!\n"));
437 pstrcpy(del_script
, lp_deluser_script());
440 all_string_sub(del_script
, "%u", unix_user
, sizeof(del_script
));
441 ret
= smbrun(del_script
,NULL
);
443 DEBUG(ret
? 0 : 3,("smb_delete_user: Running the command `%s' gave %d\n",del_script
,ret
));
448 static NTSTATUS
pdb_default_delete_user(struct pdb_methods
*methods
,
450 struct samu
*sam_acct
)
454 status
= pdb_delete_sam_account(sam_acct
);
455 if (!NT_STATUS_IS_OK(status
)) {
460 * Now delete the unix side ....
461 * note: we don't check if the delete really happened as the script is
462 * not necessary present and maybe the sysadmin doesn't want to delete
465 smb_delete_user( pdb_get_username(sam_acct
) );
470 NTSTATUS
pdb_delete_user(TALLOC_CTX
*mem_ctx
, struct samu
*sam_acct
)
472 struct pdb_methods
*pdb
= pdb_get_methods();
476 return NT_STATUS_UNSUCCESSFUL
;
479 /* sanity check to make sure we don't delete root */
481 if ( !sid_to_uid( pdb_get_user_sid(sam_acct
), &uid
) ) {
482 return NT_STATUS_NO_SUCH_USER
;
486 return NT_STATUS_ACCESS_DENIED
;
489 return pdb
->delete_user(pdb
, mem_ctx
, sam_acct
);
492 NTSTATUS
pdb_add_sam_account(struct samu
*sam_acct
)
494 struct pdb_methods
*pdb
= pdb_get_methods();
497 return NT_STATUS_UNSUCCESSFUL
;
500 return pdb
->add_sam_account(pdb
, sam_acct
);
503 NTSTATUS
pdb_update_sam_account(struct samu
*sam_acct
)
505 struct pdb_methods
*pdb
= pdb_get_methods();
508 return NT_STATUS_UNSUCCESSFUL
;
511 if (csamuser
!= NULL
) {
512 TALLOC_FREE(csamuser
);
516 return pdb
->update_sam_account(pdb
, sam_acct
);
519 NTSTATUS
pdb_delete_sam_account(struct samu
*sam_acct
)
521 struct pdb_methods
*pdb
= pdb_get_methods();
524 return NT_STATUS_UNSUCCESSFUL
;
527 if (csamuser
!= NULL
) {
528 TALLOC_FREE(csamuser
);
532 return pdb
->delete_sam_account(pdb
, sam_acct
);
535 NTSTATUS
pdb_rename_sam_account(struct samu
*oldname
, const char *newname
)
537 struct pdb_methods
*pdb
= pdb_get_methods();
541 return NT_STATUS_NOT_IMPLEMENTED
;
544 if (csamuser
!= NULL
) {
545 TALLOC_FREE(csamuser
);
549 /* sanity check to make sure we don't rename root */
551 if ( !sid_to_uid( pdb_get_user_sid(oldname
), &uid
) ) {
552 return NT_STATUS_NO_SUCH_USER
;
556 return NT_STATUS_ACCESS_DENIED
;
559 return pdb
->rename_sam_account(pdb
, oldname
, newname
);
562 NTSTATUS
pdb_update_login_attempts(struct samu
*sam_acct
, BOOL success
)
564 struct pdb_methods
*pdb
= pdb_get_methods();
567 return NT_STATUS_NOT_IMPLEMENTED
;
570 return pdb
->update_login_attempts(pdb
, sam_acct
, success
);
573 BOOL
pdb_getgrsid(GROUP_MAP
*map
, DOM_SID sid
)
575 struct pdb_methods
*pdb
= pdb_get_methods();
581 return NT_STATUS_IS_OK(pdb
->getgrsid(pdb
, map
, sid
));
584 BOOL
pdb_getgrgid(GROUP_MAP
*map
, gid_t gid
)
586 struct pdb_methods
*pdb
= pdb_get_methods();
592 return NT_STATUS_IS_OK(pdb
->getgrgid(pdb
, map
, gid
));
595 BOOL
pdb_getgrnam(GROUP_MAP
*map
, const char *name
)
597 struct pdb_methods
*pdb
= pdb_get_methods();
603 return NT_STATUS_IS_OK(pdb
->getgrnam(pdb
, map
, name
));
606 static NTSTATUS
pdb_default_create_dom_group(struct pdb_methods
*methods
,
614 grp
= getgrnam(name
);
619 if (smb_create_group(name
, &gid
) != 0) {
620 return NT_STATUS_ACCESS_DENIED
;
627 return NT_STATUS_ACCESS_DENIED
;
630 if (pdb_rid_algorithm()) {
631 *rid
= pdb_gid_to_group_rid( grp
->gr_gid
);
633 if (!pdb_new_rid(rid
)) {
634 return NT_STATUS_ACCESS_DENIED
;
638 sid_compose(&group_sid
, get_global_sam_sid(), *rid
);
640 return add_initial_entry(grp
->gr_gid
, sid_string_static(&group_sid
),
641 SID_NAME_DOM_GRP
, name
, NULL
);
644 NTSTATUS
pdb_create_dom_group(TALLOC_CTX
*mem_ctx
, const char *name
,
647 struct pdb_methods
*pdb
= pdb_get_methods();
650 return NT_STATUS_UNSUCCESSFUL
;
653 return pdb
->create_dom_group(pdb
, mem_ctx
, name
, rid
);
656 static NTSTATUS
pdb_default_delete_dom_group(struct pdb_methods
*methods
,
664 const char *grp_name
;
666 sid_compose(&group_sid
, get_global_sam_sid(), rid
);
668 if (!get_domain_group_from_sid(group_sid
, &map
)) {
669 DEBUG(10, ("Could not find group for rid %d\n", rid
));
670 return NT_STATUS_NO_SUCH_GROUP
;
673 /* We need the group name for the smb_delete_group later on */
675 if (map
.gid
== (gid_t
)-1) {
676 return NT_STATUS_NO_SUCH_GROUP
;
679 grp
= getgrgid(map
.gid
);
681 return NT_STATUS_NO_SUCH_GROUP
;
684 /* Copy the name, no idea what pdb_delete_group_mapping_entry does.. */
686 grp_name
= talloc_strdup(mem_ctx
, grp
->gr_name
);
687 if (grp_name
== NULL
) {
688 return NT_STATUS_NO_MEMORY
;
691 status
= pdb_delete_group_mapping_entry(group_sid
);
693 if (!NT_STATUS_IS_OK(status
)) {
697 /* Don't check the result of smb_delete_group */
699 smb_delete_group(grp_name
);
704 NTSTATUS
pdb_delete_dom_group(TALLOC_CTX
*mem_ctx
, uint32 rid
)
706 struct pdb_methods
*pdb
= pdb_get_methods();
709 return NT_STATUS_UNSUCCESSFUL
;
712 return pdb
->delete_dom_group(pdb
, mem_ctx
, rid
);
715 NTSTATUS
pdb_add_group_mapping_entry(GROUP_MAP
*map
)
717 struct pdb_methods
*pdb
= pdb_get_methods();
720 return NT_STATUS_UNSUCCESSFUL
;
723 return pdb
->add_group_mapping_entry(pdb
, map
);
726 NTSTATUS
pdb_update_group_mapping_entry(GROUP_MAP
*map
)
728 struct pdb_methods
*pdb
= pdb_get_methods();
731 return NT_STATUS_UNSUCCESSFUL
;
734 return pdb
->update_group_mapping_entry(pdb
, map
);
737 NTSTATUS
pdb_delete_group_mapping_entry(DOM_SID sid
)
739 struct pdb_methods
*pdb
= pdb_get_methods();
742 return NT_STATUS_UNSUCCESSFUL
;
745 return pdb
->delete_group_mapping_entry(pdb
, sid
);
748 BOOL
pdb_enum_group_mapping(const DOM_SID
*sid
, enum SID_NAME_USE sid_name_use
, GROUP_MAP
**pp_rmap
,
749 size_t *p_num_entries
, BOOL unix_only
)
751 struct pdb_methods
*pdb
= pdb_get_methods();
757 return NT_STATUS_IS_OK(pdb
-> enum_group_mapping(pdb
, sid
, sid_name_use
,
758 pp_rmap
, p_num_entries
, unix_only
));
761 NTSTATUS
pdb_enum_group_members(TALLOC_CTX
*mem_ctx
,
763 uint32
**pp_member_rids
,
764 size_t *p_num_members
)
766 struct pdb_methods
*pdb
= pdb_get_methods();
770 return NT_STATUS_UNSUCCESSFUL
;
773 result
= pdb
->enum_group_members(pdb
, mem_ctx
,
774 sid
, pp_member_rids
, p_num_members
);
776 /* special check for rid 513 */
778 if ( !NT_STATUS_IS_OK( result
) ) {
781 sid_peek_rid( sid
, &rid
);
783 if ( rid
== DOMAIN_GROUP_RID_USERS
) {
785 *pp_member_rids
= NULL
;
794 NTSTATUS
pdb_enum_group_memberships(TALLOC_CTX
*mem_ctx
, struct samu
*user
,
795 DOM_SID
**pp_sids
, gid_t
**pp_gids
,
796 size_t *p_num_groups
)
798 struct pdb_methods
*pdb
= pdb_get_methods();
801 return NT_STATUS_UNSUCCESSFUL
;
804 return pdb
->enum_group_memberships(
806 pp_sids
, pp_gids
, p_num_groups
);
809 static NTSTATUS
pdb_default_set_unix_primary_group(struct pdb_methods
*methods
,
811 struct samu
*sampass
)
816 if (!sid_to_gid(pdb_get_group_sid(sampass
), &gid
) ||
817 (grp
= getgrgid(gid
)) == NULL
) {
818 return NT_STATUS_INVALID_PRIMARY_GROUP
;
821 if (smb_set_primary_group(grp
->gr_name
,
822 pdb_get_username(sampass
)) != 0) {
823 return NT_STATUS_ACCESS_DENIED
;
829 NTSTATUS
pdb_set_unix_primary_group(TALLOC_CTX
*mem_ctx
, struct samu
*user
)
831 struct pdb_methods
*pdb
= pdb_get_methods();
834 return NT_STATUS_UNSUCCESSFUL
;
837 return pdb
->set_unix_primary_group(pdb
, mem_ctx
, user
);
841 * Helper function to see whether a user is in a group. We can't use
842 * user_in_group_sid here because this creates dependencies only smbd can
846 static BOOL
pdb_user_in_group(TALLOC_CTX
*mem_ctx
, struct samu
*account
,
847 const DOM_SID
*group_sid
)
851 size_t i
, num_groups
;
853 if (!NT_STATUS_IS_OK(pdb_enum_group_memberships(mem_ctx
, account
,
859 for (i
=0; i
<num_groups
; i
++) {
860 if (sid_equal(group_sid
, &sids
[i
])) {
867 static NTSTATUS
pdb_default_add_groupmem(struct pdb_methods
*methods
,
872 DOM_SID group_sid
, member_sid
;
873 struct samu
*account
= NULL
;
877 const char *group_name
;
880 sid_compose(&group_sid
, get_global_sam_sid(), group_rid
);
881 sid_compose(&member_sid
, get_global_sam_sid(), member_rid
);
883 if (!get_domain_group_from_sid(group_sid
, &map
) ||
884 (map
.gid
== (gid_t
)-1) ||
885 ((grp
= getgrgid(map
.gid
)) == NULL
)) {
886 return NT_STATUS_NO_SUCH_GROUP
;
889 group_name
= talloc_strdup(mem_ctx
, grp
->gr_name
);
890 if (group_name
== NULL
) {
891 return NT_STATUS_NO_MEMORY
;
894 if ( !(account
= samu_new( NULL
)) ) {
895 return NT_STATUS_NO_MEMORY
;
898 if (!pdb_getsampwsid(account
, &member_sid
) ||
899 !sid_to_uid(&member_sid
, &uid
) ||
900 ((pwd
= getpwuid_alloc(mem_ctx
, uid
)) == NULL
)) {
901 return NT_STATUS_NO_SUCH_USER
;
904 if (pdb_user_in_group(mem_ctx
, account
, &group_sid
)) {
905 return NT_STATUS_MEMBER_IN_GROUP
;
909 * ok, the group exist, the user exist, the user is not in the group,
910 * we can (finally) add it to the group !
913 smb_add_user_group(group_name
, pwd
->pw_name
);
915 if (!pdb_user_in_group(mem_ctx
, account
, &group_sid
)) {
916 return NT_STATUS_ACCESS_DENIED
;
922 NTSTATUS
pdb_add_groupmem(TALLOC_CTX
*mem_ctx
, uint32 group_rid
,
925 struct pdb_methods
*pdb
= pdb_get_methods();
928 return NT_STATUS_UNSUCCESSFUL
;
931 return pdb
->add_groupmem(pdb
, mem_ctx
, group_rid
, member_rid
);
934 static NTSTATUS
pdb_default_del_groupmem(struct pdb_methods
*methods
,
939 DOM_SID group_sid
, member_sid
;
940 struct samu
*account
= NULL
;
944 const char *group_name
;
947 sid_compose(&group_sid
, get_global_sam_sid(), group_rid
);
948 sid_compose(&member_sid
, get_global_sam_sid(), member_rid
);
950 if (!get_domain_group_from_sid(group_sid
, &map
) ||
951 (map
.gid
== (gid_t
)-1) ||
952 ((grp
= getgrgid(map
.gid
)) == NULL
)) {
953 return NT_STATUS_NO_SUCH_GROUP
;
956 group_name
= talloc_strdup(mem_ctx
, grp
->gr_name
);
957 if (group_name
== NULL
) {
958 return NT_STATUS_NO_MEMORY
;
961 if ( !(account
= samu_new( NULL
)) ) {
962 return NT_STATUS_NO_MEMORY
;
965 if (!pdb_getsampwsid(account
, &member_sid
) ||
966 !sid_to_uid(&member_sid
, &uid
) ||
967 ((pwd
= getpwuid_alloc(mem_ctx
, uid
)) == NULL
)) {
968 return NT_STATUS_NO_SUCH_USER
;
971 if (!pdb_user_in_group(mem_ctx
, account
, &group_sid
)) {
972 return NT_STATUS_MEMBER_NOT_IN_GROUP
;
976 * ok, the group exist, the user exist, the user is in the group,
977 * we can (finally) delete it from the group!
980 smb_delete_user_group(group_name
, pwd
->pw_name
);
982 if (pdb_user_in_group(mem_ctx
, account
, &group_sid
)) {
983 return NT_STATUS_ACCESS_DENIED
;
989 NTSTATUS
pdb_del_groupmem(TALLOC_CTX
*mem_ctx
, uint32 group_rid
,
992 struct pdb_methods
*pdb
= pdb_get_methods();
995 return NT_STATUS_UNSUCCESSFUL
;
998 return pdb
->del_groupmem(pdb
, mem_ctx
, group_rid
, member_rid
);
1001 BOOL
pdb_find_alias(const char *name
, DOM_SID
*sid
)
1003 struct pdb_methods
*pdb
= pdb_get_methods();
1009 return NT_STATUS_IS_OK(pdb
->find_alias(pdb
, name
, sid
));
1012 NTSTATUS
pdb_create_alias(const char *name
, uint32
*rid
)
1014 struct pdb_methods
*pdb
= pdb_get_methods();
1017 return NT_STATUS_NOT_IMPLEMENTED
;
1020 return pdb
->create_alias(pdb
, name
, rid
);
1023 BOOL
pdb_delete_alias(const DOM_SID
*sid
)
1025 struct pdb_methods
*pdb
= pdb_get_methods();
1031 return NT_STATUS_IS_OK(pdb
->delete_alias(pdb
, sid
));
1035 BOOL
pdb_get_aliasinfo(const DOM_SID
*sid
, struct acct_info
*info
)
1037 struct pdb_methods
*pdb
= pdb_get_methods();
1043 return NT_STATUS_IS_OK(pdb
->get_aliasinfo(pdb
, sid
, info
));
1046 BOOL
pdb_set_aliasinfo(const DOM_SID
*sid
, struct acct_info
*info
)
1048 struct pdb_methods
*pdb
= pdb_get_methods();
1054 return NT_STATUS_IS_OK(pdb
->set_aliasinfo(pdb
, sid
, info
));
1057 NTSTATUS
pdb_add_aliasmem(const DOM_SID
*alias
, const DOM_SID
*member
)
1059 struct pdb_methods
*pdb
= pdb_get_methods();
1062 return NT_STATUS_UNSUCCESSFUL
;
1065 return pdb
->add_aliasmem(pdb
, alias
, member
);
1068 NTSTATUS
pdb_del_aliasmem(const DOM_SID
*alias
, const DOM_SID
*member
)
1070 struct pdb_methods
*pdb
= pdb_get_methods();
1073 return NT_STATUS_UNSUCCESSFUL
;
1076 return pdb
->del_aliasmem(pdb
, alias
, member
);
1079 NTSTATUS
pdb_enum_aliasmem(const DOM_SID
*alias
,
1080 DOM_SID
**pp_members
, size_t *p_num_members
)
1082 struct pdb_methods
*pdb
= pdb_get_methods();
1085 return NT_STATUS_UNSUCCESSFUL
;
1088 return pdb
->enum_aliasmem(pdb
, alias
,
1089 pp_members
, p_num_members
);
1092 NTSTATUS
pdb_enum_alias_memberships(TALLOC_CTX
*mem_ctx
,
1093 const DOM_SID
*domain_sid
,
1094 const DOM_SID
*members
, size_t num_members
,
1095 uint32
**pp_alias_rids
,
1096 size_t *p_num_alias_rids
)
1098 struct pdb_methods
*pdb
= pdb_get_methods();
1101 return NT_STATUS_NOT_IMPLEMENTED
;
1104 return pdb
->enum_alias_memberships(pdb
, mem_ctx
,
1106 members
, num_members
,
1111 NTSTATUS
pdb_lookup_rids(const DOM_SID
*domain_sid
,
1117 struct pdb_methods
*pdb
= pdb_get_methods();
1120 return NT_STATUS_NOT_IMPLEMENTED
;
1123 return pdb
->lookup_rids(pdb
, domain_sid
,
1124 num_rids
, rids
, names
, attrs
);
1127 NTSTATUS
pdb_lookup_names(const DOM_SID
*domain_sid
,
1133 struct pdb_methods
*pdb
= pdb_get_methods();
1136 return NT_STATUS_NOT_IMPLEMENTED
;
1139 return pdb
->lookup_names(pdb
, domain_sid
,
1140 num_names
, names
, rids
, attrs
);
1143 BOOL
pdb_get_account_policy(int policy_index
, uint32
*value
)
1145 struct pdb_methods
*pdb
= pdb_get_methods();
1151 return NT_STATUS_IS_OK(pdb
->get_account_policy(pdb
, policy_index
, value
));
1154 BOOL
pdb_set_account_policy(int policy_index
, uint32 value
)
1156 struct pdb_methods
*pdb
= pdb_get_methods();
1162 return NT_STATUS_IS_OK(pdb
->set_account_policy(pdb
, policy_index
, value
));
1165 BOOL
pdb_get_seq_num(time_t *seq_num
)
1167 struct pdb_methods
*pdb
= pdb_get_methods();
1173 return NT_STATUS_IS_OK(pdb
->get_seq_num(pdb
, seq_num
));
1176 BOOL
pdb_uid_to_rid(uid_t uid
, uint32
*rid
)
1178 struct pdb_methods
*pdb
= pdb_get_methods();
1184 return pdb
->uid_to_rid(pdb
, uid
, rid
);
1187 BOOL
pdb_gid_to_sid(gid_t gid
, DOM_SID
*sid
)
1189 struct pdb_methods
*pdb
= pdb_get_methods();
1195 return pdb
->gid_to_sid(pdb
, gid
, sid
);
1198 BOOL
pdb_sid_to_id(const DOM_SID
*sid
, union unid_t
*id
,
1199 enum SID_NAME_USE
*type
)
1201 struct pdb_methods
*pdb
= pdb_get_methods();
1207 return pdb
->sid_to_id(pdb
, sid
, id
, type
);
1210 BOOL
pdb_rid_algorithm(void)
1212 struct pdb_methods
*pdb
= pdb_get_methods();
1218 return pdb
->rid_algorithm(pdb
);
1221 /********************************************************************
1222 Allocate a new RID from the passdb backend. Verify that it is free
1223 by calling lookup_global_sam_rid() to verify that the RID is not
1224 in use. This handles servers that have existing users or groups
1225 with add RIDs (assigned from previous algorithmic mappings)
1226 ********************************************************************/
1228 BOOL
pdb_new_rid(uint32
*rid
)
1230 struct pdb_methods
*pdb
= pdb_get_methods();
1231 const char *name
= NULL
;
1232 enum SID_NAME_USE type
;
1233 uint32 allocated_rid
= 0;
1241 if (pdb_rid_algorithm()) {
1242 DEBUG(0, ("Trying to allocate a RID when algorithmic RIDs "
1247 if (algorithmic_rid_base() != BASE_RID
) {
1248 DEBUG(0, ("'algorithmic rid base' is set but a passdb backend "
1249 "without algorithmic RIDs is chosen.\n"));
1250 DEBUGADD(0, ("Please map all used groups using 'net groupmap "
1251 "add', set the maximum used RID using\n"));
1252 DEBUGADD(0, ("'net setmaxrid' and remove the parameter\n"));
1256 if ( (ctx
= talloc_init("pdb_new_rid")) == NULL
) {
1257 DEBUG(0,("pdb_new_rid: Talloc initialization failure\n"));
1261 /* Attempt to get an unused RID (max tires is 250...yes that it is
1262 and arbitrary number I pulkled out of my head). -- jerry */
1264 for ( i
=0; allocated_rid
==0 && i
<250; i
++ ) {
1267 if ( !pdb
->new_rid(pdb
, &allocated_rid
) ) {
1271 /* validate that the RID is not in use */
1273 if ( lookup_global_sam_rid( ctx
, allocated_rid
, &name
, &type
, NULL
) ) {
1280 if ( allocated_rid
== 0 ) {
1281 DEBUG(0,("pdb_new_rid: Failed to find unused RID\n"));
1285 *rid
= allocated_rid
;
1290 /***************************************************************
1291 Initialize the static context (at smbd startup etc).
1293 If uninitialised, context will auto-init on first use.
1294 ***************************************************************/
1296 BOOL
initialize_password_db(BOOL reload
)
1298 return (pdb_get_methods_reload(reload
) != NULL
);
1302 /***************************************************************************
1303 Default implementations of some functions.
1304 ****************************************************************************/
1306 static NTSTATUS
pdb_default_getsampwnam (struct pdb_methods
*methods
, struct samu
*user
, const char *sname
)
1308 return NT_STATUS_NO_SUCH_USER
;
1311 static NTSTATUS
pdb_default_getsampwsid(struct pdb_methods
*my_methods
, struct samu
* user
, const DOM_SID
*sid
)
1313 return NT_STATUS_NO_SUCH_USER
;
1316 static NTSTATUS
pdb_default_add_sam_account (struct pdb_methods
*methods
, struct samu
*newpwd
)
1318 return NT_STATUS_NOT_IMPLEMENTED
;
1321 static NTSTATUS
pdb_default_update_sam_account (struct pdb_methods
*methods
, struct samu
*newpwd
)
1323 return NT_STATUS_NOT_IMPLEMENTED
;
1326 static NTSTATUS
pdb_default_delete_sam_account (struct pdb_methods
*methods
, struct samu
*pwd
)
1328 return NT_STATUS_NOT_IMPLEMENTED
;
1331 static NTSTATUS
pdb_default_rename_sam_account (struct pdb_methods
*methods
, struct samu
*pwd
, const char *newname
)
1333 return NT_STATUS_NOT_IMPLEMENTED
;
1336 static NTSTATUS
pdb_default_update_login_attempts (struct pdb_methods
*methods
, struct samu
*newpwd
, BOOL success
)
1338 return NT_STATUS_OK
;
1341 static NTSTATUS
pdb_default_setsampwent(struct pdb_methods
*methods
, BOOL update
, uint32 acb_mask
)
1343 return NT_STATUS_NOT_IMPLEMENTED
;
1346 static NTSTATUS
pdb_default_getsampwent(struct pdb_methods
*methods
, struct samu
*user
)
1348 return NT_STATUS_NOT_IMPLEMENTED
;
1351 static void pdb_default_endsampwent(struct pdb_methods
*methods
)
1353 return; /* NT_STATUS_NOT_IMPLEMENTED; */
1356 static NTSTATUS
pdb_default_get_account_policy(struct pdb_methods
*methods
, int policy_index
, uint32
*value
)
1358 return account_policy_get(policy_index
, value
) ? NT_STATUS_OK
: NT_STATUS_UNSUCCESSFUL
;
1361 static NTSTATUS
pdb_default_set_account_policy(struct pdb_methods
*methods
, int policy_index
, uint32 value
)
1363 return account_policy_set(policy_index
, value
) ? NT_STATUS_OK
: NT_STATUS_UNSUCCESSFUL
;
1366 static NTSTATUS
pdb_default_get_seq_num(struct pdb_methods
*methods
, time_t *seq_num
)
1368 *seq_num
= time(NULL
);
1369 return NT_STATUS_OK
;
1372 static BOOL
pdb_default_uid_to_rid(struct pdb_methods
*methods
, uid_t uid
,
1375 struct samu
*sampw
= NULL
;
1376 struct passwd
*unix_pw
;
1379 unix_pw
= sys_getpwuid( uid
);
1382 DEBUG(4,("pdb_default_uid_to_rid: host has no idea of uid "
1383 "%lu\n", (unsigned long)uid
));
1387 if ( !(sampw
= samu_new( NULL
)) ) {
1388 DEBUG(0,("pdb_default_uid_to_rid: samu_new() failed!\n"));
1393 ret
= NT_STATUS_IS_OK(
1394 methods
->getsampwnam(methods
, sampw
, unix_pw
->pw_name
));
1398 DEBUG(5, ("pdb_default_uid_to_rid: Did not find user "
1399 "%s (%d)\n", unix_pw
->pw_name
, uid
));
1404 ret
= sid_peek_check_rid(get_global_sam_sid(),
1405 pdb_get_user_sid(sampw
), rid
);
1408 DEBUG(1, ("Could not peek rid out of sid %s\n",
1409 sid_string_static(pdb_get_user_sid(sampw
))));
1416 static BOOL
pdb_default_gid_to_sid(struct pdb_methods
*methods
, gid_t gid
,
1421 if (!NT_STATUS_IS_OK(methods
->getgrgid(methods
, &map
, gid
))) {
1425 sid_copy(sid
, &map
.sid
);
1429 static BOOL
pdb_default_sid_to_id(struct pdb_methods
*methods
,
1431 union unid_t
*id
, enum SID_NAME_USE
*type
)
1433 TALLOC_CTX
*mem_ctx
;
1438 mem_ctx
= talloc_new(NULL
);
1440 if (mem_ctx
== NULL
) {
1441 DEBUG(0, ("talloc_new failed\n"));
1445 if (sid_peek_check_rid(get_global_sam_sid(), sid
, &rid
)) {
1446 /* Here we might have users as well as groups and aliases */
1447 ret
= lookup_global_sam_rid(mem_ctx
, rid
, &name
, type
, id
);
1451 if (sid_peek_check_rid(&global_sid_Builtin
, sid
, &rid
)) {
1452 /* Here we only have aliases */
1454 if (!NT_STATUS_IS_OK(methods
->getgrsid(methods
, &map
, *sid
))) {
1455 DEBUG(10, ("Could not find map for sid %s\n",
1456 sid_string_static(sid
)));
1459 if ((map
.sid_name_use
!= SID_NAME_ALIAS
) &&
1460 (map
.sid_name_use
!= SID_NAME_WKN_GRP
)) {
1461 DEBUG(10, ("Map for sid %s is a %s, expected an "
1462 "alias\n", sid_string_static(sid
),
1463 sid_type_lookup(map
.sid_name_use
)));
1468 *type
= SID_NAME_ALIAS
;
1473 DEBUG(5, ("Sid %s is neither ours nor builtin, don't know it\n",
1474 sid_string_static(sid
)));
1478 TALLOC_FREE(mem_ctx
);
1482 static void add_uid_to_array_unique(TALLOC_CTX
*mem_ctx
,
1483 uid_t uid
, uid_t
**pp_uids
, size_t *p_num
)
1487 for (i
=0; i
<*p_num
; i
++) {
1488 if ((*pp_uids
)[i
] == uid
)
1492 *pp_uids
= TALLOC_REALLOC_ARRAY(mem_ctx
, *pp_uids
, uid_t
, *p_num
+1);
1494 if (*pp_uids
== NULL
)
1497 (*pp_uids
)[*p_num
] = uid
;
1501 static BOOL
get_memberuids(TALLOC_CTX
*mem_ctx
, gid_t gid
, uid_t
**pp_uids
, size_t *p_num
)
1511 /* We only look at our own sam, so don't care about imported stuff */
1513 winbindd_env
= getenv(WINBINDD_DONT_ENV
);
1516 if ((grp
= getgrgid(gid
)) == NULL
) {
1517 /* allow winbindd lookups, but only if they weren't already disabled */
1518 if ( !(winbindd_env
&& strequal(winbindd_env
, "1")) ) {
1525 /* Primary group members */
1528 while ((pwd
= getpwent()) != NULL
) {
1529 if (pwd
->pw_gid
== gid
) {
1530 add_uid_to_array_unique(mem_ctx
, pwd
->pw_uid
,
1536 /* Secondary group members */
1538 for (gr
= grp
->gr_mem
; (*gr
!= NULL
) && ((*gr
)[0] != '\0'); gr
+= 1) {
1539 struct passwd
*pw
= getpwnam(*gr
);
1543 add_uid_to_array_unique(mem_ctx
, pw
->pw_uid
, pp_uids
, p_num
);
1546 /* allow winbindd lookups, but only if they weren't already disabled */
1548 if ( !(winbindd_env
&& strequal(winbindd_env
, "1")) ) {
1555 NTSTATUS
pdb_default_enum_group_members(struct pdb_methods
*methods
,
1556 TALLOC_CTX
*mem_ctx
,
1557 const DOM_SID
*group
,
1558 uint32
**pp_member_rids
,
1559 size_t *p_num_members
)
1565 *pp_member_rids
= NULL
;
1568 if (!sid_to_gid(group
, &gid
))
1569 return NT_STATUS_NO_SUCH_GROUP
;
1571 if(!get_memberuids(mem_ctx
, gid
, &uids
, &num_uids
))
1572 return NT_STATUS_NO_SUCH_GROUP
;
1575 return NT_STATUS_OK
;
1577 *pp_member_rids
= TALLOC_ZERO_ARRAY(mem_ctx
, uint32
, num_uids
);
1579 for (i
=0; i
<num_uids
; i
++) {
1582 uid_to_sid(&sid
, uids
[i
]);
1584 if (!sid_check_is_in_our_domain(&sid
)) {
1585 DEBUG(5, ("Inconsistent SAM -- group member uid not "
1586 "in our domain\n"));
1590 sid_peek_rid(&sid
, &(*pp_member_rids
)[*p_num_members
]);
1591 *p_num_members
+= 1;
1594 return NT_STATUS_OK
;
1597 NTSTATUS
pdb_default_enum_group_memberships(struct pdb_methods
*methods
,
1598 TALLOC_CTX
*mem_ctx
,
1602 size_t *p_num_groups
)
1607 const char *username
= pdb_get_username(user
);
1610 /* Ignore the primary group SID. Honor the real Unix primary group.
1611 The primary group SID is only of real use to Windows clients */
1613 if ( !(pw
= getpwnam_alloc(mem_ctx
, username
)) ) {
1614 return NT_STATUS_NO_SUCH_USER
;
1621 if (!getgroups_unix_user(mem_ctx
, username
, gid
, pp_gids
, p_num_groups
)) {
1622 return NT_STATUS_NO_SUCH_USER
;
1625 if (*p_num_groups
== 0) {
1626 smb_panic("primary group missing");
1629 *pp_sids
= TALLOC_ARRAY(mem_ctx
, DOM_SID
, *p_num_groups
);
1631 if (*pp_sids
== NULL
) {
1632 TALLOC_FREE(*pp_gids
);
1633 return NT_STATUS_NO_MEMORY
;
1636 for (i
=0; i
<*p_num_groups
; i
++) {
1637 gid_to_sid(&(*pp_sids
)[i
], (*pp_gids
)[i
]);
1640 return NT_STATUS_OK
;
1643 /*******************************************************************
1644 Look up a rid in the SAM we're responsible for (i.e. passdb)
1645 ********************************************************************/
1647 static BOOL
lookup_global_sam_rid(TALLOC_CTX
*mem_ctx
, uint32 rid
,
1649 enum SID_NAME_USE
*psid_name_use
,
1650 union unid_t
*unix_id
)
1652 struct samu
*sam_account
= NULL
;
1657 *psid_name_use
= SID_NAME_UNKNOWN
;
1659 DEBUG(5,("lookup_global_sam_rid: looking up RID %u.\n",
1660 (unsigned int)rid
));
1662 sid_copy(&sid
, get_global_sam_sid());
1663 sid_append_rid(&sid
, rid
);
1665 /* see if the passdb can help us with the name of the user */
1667 if ( !(sam_account
= samu_new( NULL
)) ) {
1671 /* BEING ROOT BLLOCK */
1673 if (pdb_getsampwsid(sam_account
, &sid
)) {
1676 unbecome_root(); /* -----> EXIT BECOME_ROOT() */
1677 *name
= talloc_strdup(mem_ctx
, pdb_get_username(sam_account
));
1678 *psid_name_use
= SID_NAME_USER
;
1680 TALLOC_FREE(sam_account
);
1682 if (unix_id
== NULL
) {
1686 pw
= Get_Pwnam(*name
);
1690 unix_id
->uid
= pw
->pw_uid
;
1693 TALLOC_FREE(sam_account
);
1695 ret
= pdb_getgrsid(&map
, sid
);
1697 /* END BECOME_ROOT BLOCK */
1699 /* do not resolve SIDs to a name unless there is a valid
1700 gid associated with it */
1702 if ( ret
&& (map
.gid
!= (gid_t
)-1) ) {
1703 *name
= talloc_strdup(mem_ctx
, map
.nt_name
);
1704 *psid_name_use
= map
.sid_name_use
;
1707 unix_id
->gid
= map
.gid
;
1713 /* Windows will always map RID 513 to something. On a non-domain
1714 controller, this gets mapped to SERVER\None. */
1717 DEBUG(5, ("Can't find a unix id for an unmapped group\n"));
1721 if ( rid
== DOMAIN_GROUP_RID_USERS
) {
1722 *name
= talloc_strdup(mem_ctx
, "None" );
1723 *psid_name_use
= SID_NAME_DOM_GRP
;
1731 NTSTATUS
pdb_default_lookup_rids(struct pdb_methods
*methods
,
1732 const DOM_SID
*domain_sid
,
1740 BOOL have_mapped
= False
;
1741 BOOL have_unmapped
= False
;
1743 if (sid_check_is_builtin(domain_sid
)) {
1745 for (i
=0; i
<num_rids
; i
++) {
1748 if (lookup_builtin_rid(names
, rids
[i
], &name
)) {
1749 attrs
[i
] = SID_NAME_ALIAS
;
1751 DEBUG(5,("lookup_rids: %s:%d\n",
1752 names
[i
], attrs
[i
]));
1755 have_unmapped
= True
;
1756 attrs
[i
] = SID_NAME_UNKNOWN
;
1762 /* Should not happen, but better check once too many */
1763 if (!sid_check_is_domain(domain_sid
)) {
1764 return NT_STATUS_INVALID_HANDLE
;
1767 for (i
= 0; i
< num_rids
; i
++) {
1770 if (lookup_global_sam_rid(names
, rids
[i
], &name
, &attrs
[i
],
1773 return NT_STATUS_NO_MEMORY
;
1776 DEBUG(5,("lookup_rids: %s:%d\n", names
[i
], attrs
[i
]));
1779 have_unmapped
= True
;
1780 attrs
[i
] = SID_NAME_UNKNOWN
;
1786 result
= NT_STATUS_NONE_MAPPED
;
1789 result
= have_unmapped
? STATUS_SOME_UNMAPPED
: NT_STATUS_OK
;
1794 NTSTATUS
pdb_default_lookup_names(struct pdb_methods
*methods
,
1795 const DOM_SID
*domain_sid
,
1803 BOOL have_mapped
= False
;
1804 BOOL have_unmapped
= False
;
1806 if (sid_check_is_builtin(domain_sid
)) {
1808 for (i
=0; i
<num_names
; i
++) {
1811 if (lookup_builtin_name(names
[i
], &rid
)) {
1812 attrs
[i
] = SID_NAME_ALIAS
;
1814 DEBUG(5,("lookup_rids: %s:%d\n",
1815 names
[i
], attrs
[i
]));
1818 have_unmapped
= True
;
1819 attrs
[i
] = SID_NAME_UNKNOWN
;
1825 /* Should not happen, but better check once too many */
1826 if (!sid_check_is_domain(domain_sid
)) {
1827 return NT_STATUS_INVALID_HANDLE
;
1830 for (i
= 0; i
< num_names
; i
++) {
1831 if (lookup_global_sam_name(names
[i
], 0, &rids
[i
], &attrs
[i
])) {
1832 DEBUG(5,("lookup_names: %s-> %d:%d\n", names
[i
],
1833 rids
[i
], attrs
[i
]));
1836 have_unmapped
= True
;
1837 attrs
[i
] = SID_NAME_UNKNOWN
;
1843 result
= NT_STATUS_NONE_MAPPED
;
1846 result
= have_unmapped
? STATUS_SOME_UNMAPPED
: NT_STATUS_OK
;
1851 static struct pdb_search
*pdb_search_init(enum pdb_search_type type
)
1853 TALLOC_CTX
*mem_ctx
;
1854 struct pdb_search
*result
;
1856 mem_ctx
= talloc_init("pdb_search");
1857 if (mem_ctx
== NULL
) {
1858 DEBUG(0, ("talloc_init failed\n"));
1862 result
= TALLOC_P(mem_ctx
, struct pdb_search
);
1863 if (result
== NULL
) {
1864 DEBUG(0, ("talloc failed\n"));
1868 result
->mem_ctx
= mem_ctx
;
1869 result
->type
= type
;
1870 result
->cache
= NULL
;
1871 result
->num_entries
= 0;
1872 result
->cache_size
= 0;
1873 result
->search_ended
= False
;
1875 /* Segfault appropriately if not initialized */
1876 result
->next_entry
= NULL
;
1877 result
->search_end
= NULL
;
1882 static void fill_displayentry(TALLOC_CTX
*mem_ctx
, uint32 rid
,
1884 const char *account_name
,
1885 const char *fullname
,
1886 const char *description
,
1887 struct samr_displayentry
*entry
)
1890 entry
->acct_flags
= acct_flags
;
1892 if (account_name
!= NULL
)
1893 entry
->account_name
= talloc_strdup(mem_ctx
, account_name
);
1895 entry
->account_name
= "";
1897 if (fullname
!= NULL
)
1898 entry
->fullname
= talloc_strdup(mem_ctx
, fullname
);
1900 entry
->fullname
= "";
1902 if (description
!= NULL
)
1903 entry
->description
= talloc_strdup(mem_ctx
, description
);
1905 entry
->description
= "";
1908 static BOOL user_search_in_progress
= False
;
1909 struct user_search
{
1913 static BOOL
next_entry_users(struct pdb_search
*s
,
1914 struct samr_displayentry
*entry
)
1916 struct user_search
*state
= s
->private_data
;
1917 struct samu
*user
= NULL
;
1920 if ( !(user
= samu_new( NULL
)) ) {
1921 DEBUG(0, ("next_entry_users: samu_new() failed!\n"));
1925 if (!pdb_getsampwent(user
)) {
1930 if ((state
->acct_flags
!= 0) &&
1931 ((pdb_get_acct_ctrl(user
) & state
->acct_flags
) == 0)) {
1936 fill_displayentry(s
->mem_ctx
, pdb_get_user_rid(user
),
1937 pdb_get_acct_ctrl(user
), pdb_get_username(user
),
1938 pdb_get_fullname(user
), pdb_get_acct_desc(user
),
1945 static void search_end_users(struct pdb_search
*search
)
1948 user_search_in_progress
= False
;
1951 static BOOL
pdb_default_search_users(struct pdb_methods
*methods
,
1952 struct pdb_search
*search
,
1955 struct user_search
*state
;
1957 if (user_search_in_progress
) {
1958 DEBUG(1, ("user search in progress\n"));
1962 if (!pdb_setsampwent(False
, acct_flags
)) {
1963 DEBUG(5, ("Could not start search\n"));
1967 user_search_in_progress
= True
;
1969 state
= TALLOC_P(search
->mem_ctx
, struct user_search
);
1970 if (state
== NULL
) {
1971 DEBUG(0, ("talloc failed\n"));
1975 state
->acct_flags
= acct_flags
;
1977 search
->private_data
= state
;
1978 search
->next_entry
= next_entry_users
;
1979 search
->search_end
= search_end_users
;
1983 struct group_search
{
1985 size_t num_groups
, current_group
;
1988 static BOOL
next_entry_groups(struct pdb_search
*s
,
1989 struct samr_displayentry
*entry
)
1991 struct group_search
*state
= s
->private_data
;
1993 GROUP_MAP
*map
= &state
->groups
[state
->current_group
];
1995 if (state
->current_group
== state
->num_groups
)
1998 sid_peek_rid(&map
->sid
, &rid
);
2000 fill_displayentry(s
->mem_ctx
, rid
, 0, map
->nt_name
, NULL
, map
->comment
,
2003 state
->current_group
+= 1;
2007 static void search_end_groups(struct pdb_search
*search
)
2009 struct group_search
*state
= search
->private_data
;
2010 SAFE_FREE(state
->groups
);
2013 static BOOL
pdb_search_grouptype(struct pdb_search
*search
,
2014 const DOM_SID
*sid
, enum SID_NAME_USE type
)
2016 struct group_search
*state
;
2018 state
= TALLOC_P(search
->mem_ctx
, struct group_search
);
2019 if (state
== NULL
) {
2020 DEBUG(0, ("talloc failed\n"));
2024 if (!pdb_enum_group_mapping(sid
, type
, &state
->groups
, &state
->num_groups
,
2026 DEBUG(0, ("Could not enum groups\n"));
2030 state
->current_group
= 0;
2031 search
->private_data
= state
;
2032 search
->next_entry
= next_entry_groups
;
2033 search
->search_end
= search_end_groups
;
2037 static BOOL
pdb_default_search_groups(struct pdb_methods
*methods
,
2038 struct pdb_search
*search
)
2040 return pdb_search_grouptype(search
, get_global_sam_sid(), SID_NAME_DOM_GRP
);
2043 static BOOL
pdb_default_search_aliases(struct pdb_methods
*methods
,
2044 struct pdb_search
*search
,
2048 return pdb_search_grouptype(search
, sid
, SID_NAME_ALIAS
);
2051 static struct samr_displayentry
*pdb_search_getentry(struct pdb_search
*search
,
2054 if (idx
< search
->num_entries
)
2055 return &search
->cache
[idx
];
2057 if (search
->search_ended
)
2060 while (idx
>= search
->num_entries
) {
2061 struct samr_displayentry entry
;
2063 if (!search
->next_entry(search
, &entry
)) {
2064 search
->search_end(search
);
2065 search
->search_ended
= True
;
2069 ADD_TO_LARGE_ARRAY(search
->mem_ctx
, struct samr_displayentry
,
2070 entry
, &search
->cache
, &search
->num_entries
,
2071 &search
->cache_size
);
2074 return (search
->num_entries
> idx
) ? &search
->cache
[idx
] : NULL
;
2077 struct pdb_search
*pdb_search_users(uint32 acct_flags
)
2079 struct pdb_methods
*pdb
= pdb_get_methods();
2080 struct pdb_search
*result
;
2082 if (pdb
== NULL
) return NULL
;
2084 result
= pdb_search_init(PDB_USER_SEARCH
);
2085 if (result
== NULL
) return NULL
;
2087 if (!pdb
->search_users(pdb
, result
, acct_flags
)) {
2088 talloc_destroy(result
->mem_ctx
);
2094 struct pdb_search
*pdb_search_groups(void)
2096 struct pdb_methods
*pdb
= pdb_get_methods();
2097 struct pdb_search
*result
;
2099 if (pdb
== NULL
) return NULL
;
2101 result
= pdb_search_init(PDB_GROUP_SEARCH
);
2102 if (result
== NULL
) return NULL
;
2104 if (!pdb
->search_groups(pdb
, result
)) {
2105 talloc_destroy(result
->mem_ctx
);
2111 struct pdb_search
*pdb_search_aliases(const DOM_SID
*sid
)
2113 struct pdb_methods
*pdb
= pdb_get_methods();
2114 struct pdb_search
*result
;
2116 if (pdb
== NULL
) return NULL
;
2118 result
= pdb_search_init(PDB_ALIAS_SEARCH
);
2119 if (result
== NULL
) return NULL
;
2121 if (!pdb
->search_aliases(pdb
, result
, sid
)) {
2122 talloc_destroy(result
->mem_ctx
);
2128 uint32
pdb_search_entries(struct pdb_search
*search
,
2129 uint32 start_idx
, uint32 max_entries
,
2130 struct samr_displayentry
**result
)
2132 struct samr_displayentry
*end_entry
;
2133 uint32 end_idx
= start_idx
+max_entries
-1;
2135 /* The first entry needs to be searched after the last. Otherwise the
2136 * first entry might have moved due to a realloc during the search for
2137 * the last entry. */
2139 end_entry
= pdb_search_getentry(search
, end_idx
);
2140 *result
= pdb_search_getentry(search
, start_idx
);
2142 if (end_entry
!= NULL
)
2145 if (start_idx
>= search
->num_entries
)
2148 return search
->num_entries
- start_idx
;
2151 void pdb_search_destroy(struct pdb_search
*search
)
2156 if (!search
->search_ended
)
2157 search
->search_end(search
);
2159 talloc_destroy(search
->mem_ctx
);
2162 /*******************************************************************
2163 Create a pdb_methods structure and initialize it with the default
2164 operations. In this way a passdb module can simply implement
2165 the functionality it cares about. However, normally this is done
2166 in groups of related functions.
2167 *******************************************************************/
2169 NTSTATUS
make_pdb_method( struct pdb_methods
**methods
)
2171 /* allocate memory for the structure as its own talloc CTX */
2173 if ( !(*methods
= TALLOC_ZERO_P(NULL
, struct pdb_methods
) ) ) {
2174 return NT_STATUS_NO_MEMORY
;
2177 (*methods
)->setsampwent
= pdb_default_setsampwent
;
2178 (*methods
)->endsampwent
= pdb_default_endsampwent
;
2179 (*methods
)->getsampwent
= pdb_default_getsampwent
;
2180 (*methods
)->getsampwnam
= pdb_default_getsampwnam
;
2181 (*methods
)->getsampwsid
= pdb_default_getsampwsid
;
2182 (*methods
)->create_user
= pdb_default_create_user
;
2183 (*methods
)->delete_user
= pdb_default_delete_user
;
2184 (*methods
)->add_sam_account
= pdb_default_add_sam_account
;
2185 (*methods
)->update_sam_account
= pdb_default_update_sam_account
;
2186 (*methods
)->delete_sam_account
= pdb_default_delete_sam_account
;
2187 (*methods
)->rename_sam_account
= pdb_default_rename_sam_account
;
2188 (*methods
)->update_login_attempts
= pdb_default_update_login_attempts
;
2190 (*methods
)->getgrsid
= pdb_default_getgrsid
;
2191 (*methods
)->getgrgid
= pdb_default_getgrgid
;
2192 (*methods
)->getgrnam
= pdb_default_getgrnam
;
2193 (*methods
)->create_dom_group
= pdb_default_create_dom_group
;
2194 (*methods
)->delete_dom_group
= pdb_default_delete_dom_group
;
2195 (*methods
)->add_group_mapping_entry
= pdb_default_add_group_mapping_entry
;
2196 (*methods
)->update_group_mapping_entry
= pdb_default_update_group_mapping_entry
;
2197 (*methods
)->delete_group_mapping_entry
= pdb_default_delete_group_mapping_entry
;
2198 (*methods
)->enum_group_mapping
= pdb_default_enum_group_mapping
;
2199 (*methods
)->enum_group_members
= pdb_default_enum_group_members
;
2200 (*methods
)->enum_group_memberships
= pdb_default_enum_group_memberships
;
2201 (*methods
)->set_unix_primary_group
= pdb_default_set_unix_primary_group
;
2202 (*methods
)->add_groupmem
= pdb_default_add_groupmem
;
2203 (*methods
)->del_groupmem
= pdb_default_del_groupmem
;
2204 (*methods
)->find_alias
= pdb_default_find_alias
;
2205 (*methods
)->create_alias
= pdb_default_create_alias
;
2206 (*methods
)->delete_alias
= pdb_default_delete_alias
;
2207 (*methods
)->get_aliasinfo
= pdb_default_get_aliasinfo
;
2208 (*methods
)->set_aliasinfo
= pdb_default_set_aliasinfo
;
2209 (*methods
)->add_aliasmem
= pdb_default_add_aliasmem
;
2210 (*methods
)->del_aliasmem
= pdb_default_del_aliasmem
;
2211 (*methods
)->enum_aliasmem
= pdb_default_enum_aliasmem
;
2212 (*methods
)->enum_alias_memberships
= pdb_default_alias_memberships
;
2213 (*methods
)->lookup_rids
= pdb_default_lookup_rids
;
2214 (*methods
)->get_account_policy
= pdb_default_get_account_policy
;
2215 (*methods
)->set_account_policy
= pdb_default_set_account_policy
;
2216 (*methods
)->get_seq_num
= pdb_default_get_seq_num
;
2217 (*methods
)->uid_to_rid
= pdb_default_uid_to_rid
;
2218 (*methods
)->gid_to_sid
= pdb_default_gid_to_sid
;
2219 (*methods
)->sid_to_id
= pdb_default_sid_to_id
;
2221 (*methods
)->search_users
= pdb_default_search_users
;
2222 (*methods
)->search_groups
= pdb_default_search_groups
;
2223 (*methods
)->search_aliases
= pdb_default_search_aliases
;
2225 return NT_STATUS_OK
;