?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
r17509: same for old woody packaging stuff
[Samba.git] / source / nsswitch / winbindd_ads.c
blob07127a63166dd887e475a3f2b5559d41a0d2d45f
1 /*
2 Unix SMB/CIFS implementation.
3
4 Winbind ADS backend functions
5
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
8 Copyright (C) Gerald (Jerry) Carter 2004
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
23 */
24
25 #include "includes.h"
26 #include "winbindd.h"
27
28 #ifdef HAVE_ADS
29
30 #undef DBGC_CLASS
31 #define DBGC_CLASS DBGC_WINBIND
32
33 /*
34 return our ads connections structure for a domain. We keep the connection
35 open to make things faster
36 */
37 static ADS_STRUCT *ads_cached_connection(struct winbindd_domain *domain)
38 {
39 ADS_STRUCT *ads;
40 ADS_STATUS status;
41 enum wb_posix_mapping map_type;
42
43 DEBUG(10,("ads_cached_connection\n"));
44
45 if (domain->private_data) {
46 ads = (ADS_STRUCT *)domain->private_data;
47
48 /* check for a valid structure */
49
50 DEBUG(7, ("Current tickets expire at %d, time is now %d\n",
51 (uint32) ads->auth.expire, (uint32) time(NULL)));
52 if ( ads->config.realm && (ads->auth.expire > time(NULL))) {
53 return ads;
54 }
55 else {
56 /* we own this ADS_STRUCT so make sure it goes away */
57 ads->is_mine = True;
58 ads_destroy( &ads );
59 ads_kdestroy("MEMORY:winbind_ccache");
60 domain->private_data = NULL;
61 }
62 }
63
64 /* we don't want this to affect the users ccache */
65 setenv("KRB5CCNAME", "MEMORY:winbind_ccache", 1);
66
67 ads = ads_init(domain->alt_name, domain->name, NULL);
68 if (!ads) {
69 DEBUG(1,("ads_init for domain %s failed\n", domain->name));
70 return NULL;
71 }
72
73 /* the machine acct password might have change - fetch it every time */
74
75 SAFE_FREE(ads->auth.password);
76 SAFE_FREE(ads->auth.realm);
77
78 if ( IS_DC ) {
79 DOM_SID sid;
80 time_t last_set_time;
81
82 if ( !secrets_fetch_trusted_domain_password( domain->name, &ads->auth.password, &sid, &last_set_time ) ) {
83 ads_destroy( &ads );
84 return NULL;
85 }
86 ads->auth.realm = SMB_STRDUP( ads->server.realm );
87 strupper_m( ads->auth.realm );
88 }
89 else {
90 struct winbindd_domain *our_domain = domain;
91
92 ads->auth.password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
93
94 /* always give preference to the alt_name in our
95 primary domain if possible */
96
97 if ( !domain->primary )
98 our_domain = find_our_domain();
99
100 if ( our_domain->alt_name[0] != '\0' ) {
101 ads->auth.realm = SMB_STRDUP( our_domain->alt_name );
102 strupper_m( ads->auth.realm );
103 }
104 else
105 ads->auth.realm = SMB_STRDUP( lp_realm() );
106 }
107
108 ads->auth.renewable = WINBINDD_PAM_AUTH_KRB5_RENEW_TIME;
109
110 status = ads_connect(ads);
111 if (!ADS_ERR_OK(status) || !ads->config.realm) {
112 extern struct winbindd_methods msrpc_methods, cache_methods;
113 DEBUG(1,("ads_connect for domain %s failed: %s\n",
114 domain->name, ads_errstr(status)));
115 ads_destroy(&ads);
116
117 /* if we get ECONNREFUSED then it might be a NT4
118 server, fall back to MSRPC */
119 if (status.error_type == ENUM_ADS_ERROR_SYSTEM &&
120 status.err.rc == ECONNREFUSED) {
121 DEBUG(1,("Trying MSRPC methods\n"));
122 if (domain->methods == &cache_methods) {
123 domain->backend = &msrpc_methods;
124 } else {
125 domain->methods = &msrpc_methods;
126 }
127 }
128 return NULL;
129 }
130
131 map_type = get_nss_info(domain->name);
132
133 if ((map_type == WB_POSIX_MAP_RFC2307)||
134 (map_type == WB_POSIX_MAP_SFU)) {
135
136 status = ads_check_posix_schema_mapping(ads, map_type);
137 if (!ADS_ERR_OK(status)) {
138 DEBUG(10,("ads_check_posix_schema_mapping failed "
139 "with: %s\n", ads_errstr(status)));
140 }
141 }
142
143 /* set the flag that says we don't own the memory even
144 though we do so that ads_destroy() won't destroy the
145 structure we pass back by reference */
146
147 ads->is_mine = False;
148
149 domain->private_data = (void *)ads;
150 return ads;
151 }
152
153
154 /* Query display info for a realm. This is the basic user list fn */
155 static NTSTATUS query_user_list(struct winbindd_domain *domain,
156 TALLOC_CTX *mem_ctx,
157 uint32 *num_entries,
158 WINBIND_USERINFO **info)
159 {
160 ADS_STRUCT *ads = NULL;
161 const char *attrs[] = {"userPrincipalName",
162 "sAMAccountName",
163 "name", "objectSid", "primaryGroupID",
164 "sAMAccountType",
165 ADS_ATTR_SFU_HOMEDIR_OID,
166 ADS_ATTR_SFU_SHELL_OID,
167 ADS_ATTR_SFU_GECOS_OID,
168 ADS_ATTR_RFC2307_HOMEDIR_OID,
169 ADS_ATTR_RFC2307_SHELL_OID,
170 ADS_ATTR_RFC2307_GECOS_OID,
171 NULL};
172 int i, count;
173 ADS_STATUS rc;
174 void *res = NULL;
175 void *msg = NULL;
176 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
177
178 *num_entries = 0;
179
180 DEBUG(3,("ads: query_user_list\n"));
181
182 ads = ads_cached_connection(domain);
183
184 if (!ads) {
185 domain->last_status = NT_STATUS_SERVER_DISABLED;
186 goto done;
187 }
188
189 rc = ads_search_retry(ads, &res, "(objectCategory=user)", attrs);
190 if (!ADS_ERR_OK(rc) || !res) {
191 DEBUG(1,("query_user_list ads_search: %s\n", ads_errstr(rc)));
192 goto done;
193 }
194
195 count = ads_count_replies(ads, res);
196 if (count == 0) {
197 DEBUG(1,("query_user_list: No users found\n"));
198 goto done;
199 }
200
201 (*info) = TALLOC_ZERO_ARRAY(mem_ctx, WINBIND_USERINFO, count);
202 if (!*info) {
203 status = NT_STATUS_NO_MEMORY;
204 goto done;
205 }
206
207 i = 0;
208
209 for (msg = ads_first_entry(ads, res); msg; msg = ads_next_entry(ads, msg)) {
210 char *name, *gecos = NULL;
211 char *homedir = NULL;
212 char *shell = NULL;
213 uint32 group;
214 uint32 atype;
215
216 if (!ads_pull_uint32(ads, msg, "sAMAccountType", &atype) ||
217 ads_atype_map(atype) != SID_NAME_USER) {
218 DEBUG(1,("Not a user account? atype=0x%x\n", atype));
219 continue;
220 }
221
222 name = ads_pull_username(ads, mem_ctx, msg);
223
224 if (get_nss_info(domain->name) && ads->schema.map_type) {
225
226 DEBUG(10,("pulling posix attributes (%s schema)\n",
227 wb_posix_map_str(ads->schema.map_type)));
228
229 homedir = ads_pull_string(ads, mem_ctx, msg,
230 ads->schema.posix_homedir_attr);
231 shell = ads_pull_string(ads, mem_ctx, msg,
232 ads->schema.posix_shell_attr);
233 gecos = ads_pull_string(ads, mem_ctx, msg,
234 ads->schema.posix_gecos_attr);
235 }
236
237 if (gecos == NULL) {
238 gecos = ads_pull_string(ads, mem_ctx, msg, "name");
239 }
240
241 if (!ads_pull_sid(ads, msg, "objectSid",
242 &(*info)[i].user_sid)) {
243 DEBUG(1,("No sid for %s !?\n", name));
244 continue;
245 }
246 if (!ads_pull_uint32(ads, msg, "primaryGroupID", &group)) {
247 DEBUG(1,("No primary group for %s !?\n", name));
248 continue;
249 }
250
251 (*info)[i].acct_name = name;
252 (*info)[i].full_name = gecos;
253 (*info)[i].homedir = homedir;
254 (*info)[i].shell = shell;
255 sid_compose(&(*info)[i].group_sid, &domain->sid, group);
256 i++;
257 }
258
259 (*num_entries) = i;
260 status = NT_STATUS_OK;
261
262 DEBUG(3,("ads query_user_list gave %d entries\n", (*num_entries)));
263
264 done:
265 if (res)
266 ads_msgfree(ads, res);
267
268 return status;
269 }
270
271 /* list all domain groups */
272 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
273 TALLOC_CTX *mem_ctx,
274 uint32 *num_entries,
275 struct acct_info **info)
276 {
277 ADS_STRUCT *ads = NULL;
278 const char *attrs[] = {"userPrincipalName", "sAMAccountName",
279 "name", "objectSid", NULL};
280 int i, count;
281 ADS_STATUS rc;
282 void *res = NULL;
283 void *msg = NULL;
284 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
285 const char *filter;
286 BOOL enum_dom_local_groups = False;
287
288 *num_entries = 0;
289
290 DEBUG(3,("ads: enum_dom_groups\n"));
291
292 /* only grab domain local groups for our domain */
293 if ( domain->native_mode && strequal(lp_realm(), domain->alt_name) ) {
294 enum_dom_local_groups = True;
295 }
296
297 /* Workaround ADS LDAP bug present in MS W2K3 SP0 and W2K SP4 w/o
298 * rollup-fixes:
299 *
300 * According to Section 5.1(4) of RFC 2251 if a value of a type is it's
301 * default value, it MUST be absent. In case of extensible matching the
302 * "dnattr" boolean defaults to FALSE and so it must be only be present
303 * when set to TRUE.
304 *
305 * When it is set to FALSE and the OpenLDAP lib (correctly) encodes a
306 * filter using bitwise matching rule then the buggy AD fails to decode
307 * the extensible match. As a workaround set it to TRUE and thereby add
308 * the dnAttributes "dn" field to cope with those older AD versions.
309 * It should not harm and won't put any additional load on the AD since
310 * none of the dn components have a bitmask-attribute.
311 *
312 * Thanks to Ralf Haferkamp for input and testing - Guenther */
313
314 filter = talloc_asprintf(mem_ctx, "(&(objectCategory=group)(&(groupType:dn:%s:=%d)(!(groupType:dn:%s:=%d))))",
315 ADS_LDAP_MATCHING_RULE_BIT_AND, GROUP_TYPE_SECURITY_ENABLED,
316 ADS_LDAP_MATCHING_RULE_BIT_AND,
317 enum_dom_local_groups ? GROUP_TYPE_BUILTIN_LOCAL_GROUP : GROUP_TYPE_RESOURCE_GROUP);
318
319 if (filter == NULL) {
320 status = NT_STATUS_NO_MEMORY;
321 goto done;
322 }
323
324 ads = ads_cached_connection(domain);
325
326 if (!ads) {
327 domain->last_status = NT_STATUS_SERVER_DISABLED;
328 goto done;
329 }
330
331 rc = ads_search_retry(ads, &res, filter, attrs);
332 if (!ADS_ERR_OK(rc) || !res) {
333 DEBUG(1,("enum_dom_groups ads_search: %s\n", ads_errstr(rc)));
334 goto done;
335 }
336
337 count = ads_count_replies(ads, res);
338 if (count == 0) {
339 DEBUG(1,("enum_dom_groups: No groups found\n"));
340 goto done;
341 }
342
343 (*info) = TALLOC_ZERO_ARRAY(mem_ctx, struct acct_info, count);
344 if (!*info) {
345 status = NT_STATUS_NO_MEMORY;
346 goto done;
347 }
348
349 i = 0;
350
351 for (msg = ads_first_entry(ads, res); msg; msg = ads_next_entry(ads, msg)) {
352 char *name, *gecos;
353 DOM_SID sid;
354 uint32 rid;
355
356 name = ads_pull_username(ads, mem_ctx, msg);
357 gecos = ads_pull_string(ads, mem_ctx, msg, "name");
358 if (!ads_pull_sid(ads, msg, "objectSid", &sid)) {
359 DEBUG(1,("No sid for %s !?\n", name));
360 continue;
361 }
362
363 if (!sid_peek_check_rid(&domain->sid, &sid, &rid)) {
364 DEBUG(1,("No rid for %s !?\n", name));
365 continue;
366 }
367
368 fstrcpy((*info)[i].acct_name, name);
369 fstrcpy((*info)[i].acct_desc, gecos);
370 (*info)[i].rid = rid;
371 i++;
372 }
373
374 (*num_entries) = i;
375
376 status = NT_STATUS_OK;
377
378 DEBUG(3,("ads enum_dom_groups gave %d entries\n", (*num_entries)));
379
380 done:
381 if (res)
382 ads_msgfree(ads, res);
383
384 return status;
385 }
386
387 /* list all domain local groups */
388 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
389 TALLOC_CTX *mem_ctx,
390 uint32 *num_entries,
391 struct acct_info **info)
392 {
393 /*
394 * This is a stub function only as we returned the domain
395 * local groups in enum_dom_groups() if the domain->native field
396 * was true. This is a simple performance optimization when
397 * using LDAP.
398 *
399 * if we ever need to enumerate domain local groups separately,
400 * then this the optimization in enum_dom_groups() will need
401 * to be split out
402 */
403 *num_entries = 0;
404
405 return NT_STATUS_OK;
406 }
407
408 /* convert a DN to a name, SID and name type
409 this might become a major speed bottleneck if groups have
410 lots of users, in which case we could cache the results
411 */
412 static BOOL dn_lookup(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx,
413 const char *dn,
414 char **name, uint32 *name_type, DOM_SID *sid)
415 {
416 void *res = NULL;
417 const char *attrs[] = {"userPrincipalName", "sAMAccountName",
418 "objectSid", "sAMAccountType", NULL};
419 ADS_STATUS rc;
420 uint32 atype;
421 DEBUG(3,("ads: dn_lookup\n"));
422
423 rc = ads_search_retry_dn(ads, &res, dn, attrs);
424
425 if (!ADS_ERR_OK(rc) || !res) {
426 goto failed;
427 }
428
429 (*name) = ads_pull_username(ads, mem_ctx, res);
430
431 if (!ads_pull_uint32(ads, res, "sAMAccountType", &atype)) {
432 goto failed;
433 }
434 (*name_type) = ads_atype_map(atype);
435
436 if (!ads_pull_sid(ads, res, "objectSid", sid)) {
437 goto failed;
438 }
439
440 if (res)
441 ads_msgfree(ads, res);
442
443 return True;
444
445 failed:
446 if (res)
447 ads_msgfree(ads, res);
448
449 return False;
450 }
451
452 /* Lookup user information from a rid */
453 static NTSTATUS query_user(struct winbindd_domain *domain,
454 TALLOC_CTX *mem_ctx,
455 const DOM_SID *sid,
456 WINBIND_USERINFO *info)
457 {
458 ADS_STRUCT *ads = NULL;
459 const char *attrs[] = {"userPrincipalName",
460 "sAMAccountName",
461 "name",
462 "primaryGroupID",
463 ADS_ATTR_SFU_HOMEDIR_OID,
464 ADS_ATTR_SFU_SHELL_OID,
465 ADS_ATTR_SFU_GECOS_OID,
466 ADS_ATTR_RFC2307_HOMEDIR_OID,
467 ADS_ATTR_RFC2307_SHELL_OID,
468 ADS_ATTR_RFC2307_GECOS_OID,
469 NULL};
470 ADS_STATUS rc;
471 int count;
472 void *msg = NULL;
473 char *ldap_exp;
474 char *sidstr;
475 uint32 group_rid;
476 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
477
478 DEBUG(3,("ads: query_user\n"));
479
480 ads = ads_cached_connection(domain);
481
482 if (!ads) {
483 domain->last_status = NT_STATUS_SERVER_DISABLED;
484 goto done;
485 }
486
487 sidstr = sid_binstring(sid);
488 asprintf(&ldap_exp, "(objectSid=%s)", sidstr);
489 rc = ads_search_retry(ads, &msg, ldap_exp, attrs);
490 free(ldap_exp);
491 free(sidstr);
492 if (!ADS_ERR_OK(rc) || !msg) {
493 DEBUG(1,("query_user(sid=%s) ads_search: %s\n",
494 sid_string_static(sid), ads_errstr(rc)));
495 goto done;
496 }
497
498 count = ads_count_replies(ads, msg);
499 if (count != 1) {
500 DEBUG(1,("query_user(sid=%s): Not found\n",
501 sid_string_static(sid)));
502 goto done;
503 }
504
505 info->acct_name = ads_pull_username(ads, mem_ctx, msg);
506
507 if (get_nss_info(domain->name) && ads->schema.map_type) {
508
509 DEBUG(10,("pulling posix attributes (%s schema)\n",
510 wb_posix_map_str(ads->schema.map_type)));
511
512 info->homedir = ads_pull_string(ads, mem_ctx, msg,
513 ads->schema.posix_homedir_attr);
514 info->shell = ads_pull_string(ads, mem_ctx, msg,
515 ads->schema.posix_shell_attr);
516 info->full_name = ads_pull_string(ads, mem_ctx, msg,
517 ads->schema.posix_gecos_attr);
518 }
519
520 if (info->full_name == NULL) {
521 info->full_name = ads_pull_string(ads, mem_ctx, msg, "name");
522 }
523
524 if (!ads_pull_uint32(ads, msg, "primaryGroupID", &group_rid)) {
525 DEBUG(1,("No primary group for %s !?\n",
526 sid_string_static(sid)));
527 goto done;
528 }
529
530 sid_copy(&info->user_sid, sid);
531 sid_compose(&info->group_sid, &domain->sid, group_rid);
532
533 status = NT_STATUS_OK;
534
535 DEBUG(3,("ads query_user gave %s\n", info->acct_name));
536 done:
537 if (msg)
538 ads_msgfree(ads, msg);
539
540 return status;
541 }
542
543 /* Lookup groups a user is a member of - alternate method, for when
544 tokenGroups are not available. */
545 static NTSTATUS lookup_usergroups_member(struct winbindd_domain *domain,
546 TALLOC_CTX *mem_ctx,
547 const char *user_dn,
548 DOM_SID *primary_group,
549 size_t *p_num_groups, DOM_SID **user_sids)
550 {
551 ADS_STATUS rc;
552 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
553 int count;
554 void *res = NULL;
555 void *msg = NULL;
556 char *ldap_exp;
557 ADS_STRUCT *ads;
558 const char *group_attrs[] = {"objectSid", NULL};
559 char *escaped_dn;
560 size_t num_groups = 0;
561
562 DEBUG(3,("ads: lookup_usergroups_member\n"));
563
564 ads = ads_cached_connection(domain);
565
566 if (!ads) {
567 domain->last_status = NT_STATUS_SERVER_DISABLED;
568 goto done;
569 }
570
571 if (!(escaped_dn = escape_ldap_string_alloc(user_dn))) {
572 status = NT_STATUS_NO_MEMORY;
573 goto done;
574 }
575
576 if (!(ldap_exp = talloc_asprintf(mem_ctx, "(&(member=%s)(objectCategory=group))", escaped_dn))) {
577 DEBUG(1,("lookup_usergroups(dn=%s) asprintf failed!\n", user_dn));
578 SAFE_FREE(escaped_dn);
579 status = NT_STATUS_NO_MEMORY;
580 goto done;
581 }
582
583 SAFE_FREE(escaped_dn);
584
585 rc = ads_search_retry(ads, &res, ldap_exp, group_attrs);
586
587 if (!ADS_ERR_OK(rc) || !res) {
588 DEBUG(1,("lookup_usergroups ads_search member=%s: %s\n", user_dn, ads_errstr(rc)));
589 return ads_ntstatus(rc);
590 }
591
592 count = ads_count_replies(ads, res);
593
594 *user_sids = NULL;
595 num_groups = 0;
596
597 /* always add the primary group to the sid array */
598 add_sid_to_array(mem_ctx, primary_group, user_sids, &num_groups);
599
600 if (count > 0) {
601 for (msg = ads_first_entry(ads, res); msg;
602 msg = ads_next_entry(ads, msg)) {
603 DOM_SID group_sid;
604
605 if (!ads_pull_sid(ads, msg, "objectSid", &group_sid)) {
606 DEBUG(1,("No sid for this group ?!?\n"));
607 continue;
608 }
609
610 /* ignore Builtin groups from ADS - Guenther */
611 if (sid_check_is_in_builtin(&group_sid)) {
612 continue;
613 }
614
615 add_sid_to_array(mem_ctx, &group_sid, user_sids,
616 &num_groups);
617 }
618
619 }
620
621 *p_num_groups = num_groups;
622 status = (user_sids != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
623
624 DEBUG(3,("ads lookup_usergroups (member) succeeded for dn=%s\n", user_dn));
625 done:
626 if (res)
627 ads_msgfree(ads, res);
628
629 return status;
630 }
631
632 /* Lookup groups a user is a member of - alternate method, for when
633 tokenGroups are not available. */
634 static NTSTATUS lookup_usergroups_memberof(struct winbindd_domain *domain,
635 TALLOC_CTX *mem_ctx,
636 const char *user_dn,
637 DOM_SID *primary_group,
638 size_t *p_num_groups, DOM_SID **user_sids)
639 {
640 ADS_STATUS rc;
641 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
642 int count;
643 void *res = NULL;
644 ADS_STRUCT *ads;
645 const char *attrs[] = {"memberOf", NULL};
646 size_t num_groups = 0;
647 DOM_SID *group_sids = NULL;
648 int i;
649
650 DEBUG(3,("ads: lookup_usergroups_memberof\n"));
651
652 ads = ads_cached_connection(domain);
653
654 if (!ads) {
655 domain->last_status = NT_STATUS_SERVER_DISABLED;
656 goto done;
657 }
658
659 rc = ads_search_retry_extended_dn(ads, &res, user_dn, attrs,
660 ADS_EXTENDED_DN_HEX_STRING);
661
662 if (!ADS_ERR_OK(rc) || !res) {
663 DEBUG(1,("lookup_usergroups_memberof ads_search member=%s: %s\n",
664 user_dn, ads_errstr(rc)));
665 return ads_ntstatus(rc);
666 }
667
668 count = ads_count_replies(ads, res);
669
670 if (count == 0) {
671 status = NT_STATUS_NO_SUCH_USER;
672 goto done;
673 }
674
675 *user_sids = NULL;
676 num_groups = 0;
677
678 /* always add the primary group to the sid array */
679 add_sid_to_array(mem_ctx, primary_group, user_sids, &num_groups);
680
681 count = ads_pull_sids_from_extendeddn(ads, mem_ctx, res, "memberOf",
682 ADS_EXTENDED_DN_HEX_STRING,
683 &group_sids);
684 if (count == 0) {
685 DEBUG(1,("No memberOf for this user?!?\n"));
686 status = NT_STATUS_NO_MEMORY;
687 goto done;
688 }
689
690 for (i=0; i<count; i++) {
691
692 /* ignore Builtin groups from ADS - Guenther */
693 if (sid_check_is_in_builtin(&group_sids[i])) {
694 continue;
695 }
696
697 add_sid_to_array(mem_ctx, &group_sids[i], user_sids,
698 &num_groups);
699
700 }
701
702 *p_num_groups = num_groups;
703 status = (user_sids != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
704
705 DEBUG(3,("ads lookup_usergroups (memberof) succeeded for dn=%s\n", user_dn));
706 done:
707 TALLOC_FREE(group_sids);
708 if (res)
709 ads_msgfree(ads, res);
710
711 return status;
712 }
713
714
715 /* Lookup groups a user is a member of. */
716 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
717 TALLOC_CTX *mem_ctx,
718 const DOM_SID *sid,
719 uint32 *p_num_groups, DOM_SID **user_sids)
720 {
721 ADS_STRUCT *ads = NULL;
722 const char *attrs[] = {"tokenGroups", "primaryGroupID", NULL};
723 ADS_STATUS rc;
724 int count;
725 LDAPMessage *msg = NULL;
726 char *user_dn = NULL;
727 DOM_SID *sids;
728 int i;
729 DOM_SID primary_group;
730 uint32 primary_group_rid;
731 fstring sid_string;
732 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
733 size_t num_groups = 0;
734
735 DEBUG(3,("ads: lookup_usergroups\n"));
736 *p_num_groups = 0;
737
738 status = lookup_usergroups_cached(domain, mem_ctx, sid,
739 p_num_groups, user_sids);
740 if (NT_STATUS_IS_OK(status)) {
741 return NT_STATUS_OK;
742 }
743
744 ads = ads_cached_connection(domain);
745
746 if (!ads) {
747 domain->last_status = NT_STATUS_SERVER_DISABLED;
748 status = NT_STATUS_SERVER_DISABLED;
749 goto done;
750 }
751
752 rc = ads_search_retry_sid(ads, (void**)(void *)&msg, sid, attrs);
753
754 if (!ADS_ERR_OK(rc)) {
755 status = ads_ntstatus(rc);
756 DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: %s\n",
757 sid_to_string(sid_string, sid), ads_errstr(rc)));
758 goto done;
759 }
760
761 count = ads_count_replies(ads, msg);
762 if (count != 1) {
763 status = NT_STATUS_UNSUCCESSFUL;
764 DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: "
765 "invalid number of results (count=%d)\n",
766 sid_to_string(sid_string, sid), count));
767 goto done;
768 }
769
770 if (!msg) {
771 DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: NULL msg\n",
772 sid_to_string(sid_string, sid)));
773 status = NT_STATUS_UNSUCCESSFUL;
774 goto done;
775 }
776
777 user_dn = ads_get_dn(ads, msg);
778 if (user_dn == NULL) {
779 status = NT_STATUS_NO_MEMORY;
780 goto done;
781 }
782
783 if (!ads_pull_uint32(ads, msg, "primaryGroupID", &primary_group_rid)) {
784 DEBUG(1,("%s: No primary group for sid=%s !?\n",
785 domain->name, sid_to_string(sid_string, sid)));
786 goto done;
787 }
788
789 sid_copy(&primary_group, &domain->sid);
790 sid_append_rid(&primary_group, primary_group_rid);
791
792 count = ads_pull_sids(ads, mem_ctx, msg, "tokenGroups", &sids);
793
794 /* there must always be at least one group in the token,
795 unless we are talking to a buggy Win2k server */
796
797 /* actually this only happens when the machine account has no read
798 * permissions on the tokenGroup attribute - gd */
799
800 if (count == 0) {
801
802 /* no tokenGroups */
803
804 /* lookup what groups this user is a member of by DN search on
805 * "memberOf" */
806
807 status = lookup_usergroups_memberof(domain, mem_ctx, user_dn,
808 &primary_group,
809 &num_groups, user_sids);
810 *p_num_groups = (uint32)num_groups;
811 if (NT_STATUS_IS_OK(status)) {
812 goto done;
813 }
814
815 /* lookup what groups this user is a member of by DN search on
816 * "member" */
817
818 status = lookup_usergroups_member(domain, mem_ctx, user_dn,
819 &primary_group,
820 &num_groups, user_sids);
821 *p_num_groups = (uint32)num_groups;
822 goto done;
823 }
824
825 *user_sids = NULL;
826 num_groups = 0;
827
828 add_sid_to_array(mem_ctx, &primary_group, user_sids, &num_groups);
829
830 for (i=0;i<count;i++) {
831
832 /* ignore Builtin groups from ADS - Guenther */
833 if (sid_check_is_in_builtin(&sids[i])) {
834 continue;
835 }
836
837 add_sid_to_array_unique(mem_ctx, &sids[i],
838 user_sids, &num_groups);
839 }
840
841 *p_num_groups = (uint32)num_groups;
842 status = (user_sids != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
843
844 DEBUG(3,("ads lookup_usergroups (tokenGroups) succeeded for sid=%s\n",
845 sid_to_string(sid_string, sid)));
846 done:
847 ads_memfree(ads, user_dn);
848 ads_msgfree(ads, msg);
849 return status;
850 }
851
852 /*
853 find the members of a group, given a group rid and domain
854 */
855 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
856 TALLOC_CTX *mem_ctx,
857 const DOM_SID *group_sid, uint32 *num_names,
858 DOM_SID **sid_mem, char ***names,
859 uint32 **name_types)
860 {
861 ADS_STATUS rc;
862 int count;
863 void *res=NULL;
864 ADS_STRUCT *ads = NULL;
865 char *ldap_exp;
866 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
867 char *sidstr;
868 char **members;
869 int i;
870 size_t num_members;
871 fstring sid_string;
872 BOOL more_values;
873 const char **attrs;
874 uint32 first_usn;
875 uint32 current_usn;
876 int num_retries = 0;
877
878 DEBUG(10,("ads: lookup_groupmem %s sid=%s\n", domain->name,
879 sid_string_static(group_sid)));
880
881 *num_names = 0;
882
883 ads = ads_cached_connection(domain);
884
885 if (!ads) {
886 domain->last_status = NT_STATUS_SERVER_DISABLED;
887 goto done;
888 }
889
890 if ((sidstr = sid_binstring(group_sid)) == NULL) {
891 status = NT_STATUS_NO_MEMORY;
892 goto done;
893 }
894
895 /* search for all members of the group */
896 if (!(ldap_exp = talloc_asprintf(mem_ctx, "(objectSid=%s)",sidstr))) {
897 SAFE_FREE(sidstr);
898 DEBUG(1, ("ads: lookup_groupmem: tallloc_asprintf for ldap_exp failed!\n"));
899 status = NT_STATUS_NO_MEMORY;
900 goto done;
901 }
902 SAFE_FREE(sidstr);
903
904 members = NULL;
905 num_members = 0;
906
907 if ((attrs = TALLOC_ARRAY(mem_ctx, const char *, 3)) == NULL) {
908 status = NT_STATUS_NO_MEMORY;
909 goto done;
910 }
911
912 attrs[1] = talloc_strdup(mem_ctx, "usnChanged");
913 attrs[2] = NULL;
914
915 do {
916 if (num_members == 0)
917 attrs[0] = talloc_strdup(mem_ctx, "member");
918
919 DEBUG(10, ("Searching for attrs[0] = %s, attrs[1] = %s\n", attrs[0], attrs[1]));
920
921 rc = ads_search_retry(ads, &res, ldap_exp, attrs);
922
923 if (!ADS_ERR_OK(rc) || !res) {
924 DEBUG(1,("ads: lookup_groupmem ads_search: %s\n",
925 ads_errstr(rc)));
926 status = ads_ntstatus(rc);
927 goto done;
928 }
929
930 count = ads_count_replies(ads, res);
931 if (count == 0)
932 break;
933
934 if (num_members == 0) {
935 if (!ads_pull_uint32(ads, res, "usnChanged", &first_usn)) {
936 DEBUG(1, ("ads: lookup_groupmem could not pull usnChanged!\n"));
937 goto done;
938 }
939 }
940
941 if (!ads_pull_uint32(ads, res, "usnChanged", &current_usn)) {
942 DEBUG(1, ("ads: lookup_groupmem could not pull usnChanged!\n"));
943 goto done;
944 }
945
946 if (first_usn != current_usn) {
947 DEBUG(5, ("ads: lookup_groupmem USN on this record changed"
948 " - restarting search\n"));
949 if (num_retries < 5) {
950 num_retries++;
951 num_members = 0;
952 continue;
953 } else {
954 DEBUG(5, ("ads: lookup_groupmem USN on this record changed"
955 " - restarted search too many times, aborting!\n"));
956 status = NT_STATUS_UNSUCCESSFUL;
957 goto done;
958 }
959 }
960
961 members = ads_pull_strings_range(ads, mem_ctx, res,
962 "member",
963 members,
964 &attrs[0],
965 &num_members,
966 &more_values);
967
968 if ((members == NULL) || (num_members == 0))
969 break;
970
971 } while (more_values);
972
973 /* now we need to turn a list of members into rids, names and name types
974 the problem is that the members are in the form of distinguised names
975 */
976
977 (*sid_mem) = TALLOC_ZERO_ARRAY(mem_ctx, DOM_SID, num_members);
978 (*name_types) = TALLOC_ZERO_ARRAY(mem_ctx, uint32, num_members);
979 (*names) = TALLOC_ZERO_ARRAY(mem_ctx, char *, num_members);
980
981 if ((num_members != 0) &&
982 ((members == NULL) || (*sid_mem == NULL) ||
983 (*name_types == NULL) || (*names == NULL))) {
984 DEBUG(1, ("talloc failed\n"));
985 status = NT_STATUS_NO_MEMORY;
986 goto done;
987 }
988
989 for (i=0;i<num_members;i++) {
990 uint32 name_type;
991 char *name;
992 DOM_SID sid;
993
994 if (dn_lookup(ads, mem_ctx, members[i], &name, &name_type, &sid)) {
995 (*names)[*num_names] = name;
996 (*name_types)[*num_names] = name_type;
997 sid_copy(&(*sid_mem)[*num_names], &sid);
998 (*num_names)++;
999 }
1000 }
1001
1002 status = NT_STATUS_OK;
1003 DEBUG(3,("ads lookup_groupmem for sid=%s\n", sid_to_string(sid_string, group_sid)));
1004 done:
1005
1006 if (res)
1007 ads_msgfree(ads, res);
1008
1009 return status;
1010 }
1011
1012 /* find the sequence number for a domain */
1013 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
1014 {
1015 ADS_STRUCT *ads = NULL;
1016 ADS_STATUS rc;
1017
1018 DEBUG(3,("ads: fetch sequence_number for %s\n", domain->name));
1019
1020 *seq = DOM_SEQUENCE_NONE;
1021
1022 ads = ads_cached_connection(domain);
1023
1024 if (!ads) {
1025 domain->last_status = NT_STATUS_SERVER_DISABLED;
1026 return NT_STATUS_UNSUCCESSFUL;
1027 }
1028
1029 rc = ads_USN(ads, seq);
1030
1031 if (!ADS_ERR_OK(rc)) {
1032
1033 /* its a dead connection ; don't destroy it
1034 through since ads_USN() has already done
1035 that indirectly */
1036
1037 domain->private_data = NULL;
1038 }
1039 return ads_ntstatus(rc);
1040 }
1041
1042 /* get a list of trusted domains */
1043 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
1044 TALLOC_CTX *mem_ctx,
1045 uint32 *num_domains,
1046 char ***names,
1047 char ***alt_names,
1048 DOM_SID **dom_sids)
1049 {
1050 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1051 struct ds_domain_trust *domains = NULL;
1052 int count = 0;
1053 int i;
1054 uint32 flags = DS_DOMAIN_IN_FOREST | DS_DOMAIN_DIRECT_OUTBOUND;
1055 struct rpc_pipe_client *cli;
1056
1057 DEBUG(3,("ads: trusted_domains\n"));
1058
1059 *num_domains = 0;
1060 *alt_names = NULL;
1061 *names = NULL;
1062 *dom_sids = NULL;
1063
1064 result = cm_connect_netlogon(domain, &cli);
1065
1066 if (!NT_STATUS_IS_OK(result)) {
1067 DEBUG(5, ("trusted_domains: Could not open a connection to %s "
1068 "for PIPE_NETLOGON (%s)\n",
1069 domain->name, nt_errstr(result)));
1070 return NT_STATUS_UNSUCCESSFUL;
1071 }
1072
1073 if ( NT_STATUS_IS_OK(result) ) {
1074 result = rpccli_ds_enum_domain_trusts(cli, mem_ctx,
1075 cli->cli->desthost,
1076 flags, &domains,
1077 (unsigned int *)&count);
1078 }
1079
1080 if ( NT_STATUS_IS_OK(result) && count) {
1081
1082 /* Allocate memory for trusted domain names and sids */
1083
1084 if ( !(*names = TALLOC_ARRAY(mem_ctx, char *, count)) ) {
1085 DEBUG(0, ("trusted_domains: out of memory\n"));
1086 return NT_STATUS_NO_MEMORY;
1087 }
1088
1089 if ( !(*alt_names = TALLOC_ARRAY(mem_ctx, char *, count)) ) {
1090 DEBUG(0, ("trusted_domains: out of memory\n"));
1091 return NT_STATUS_NO_MEMORY;
1092 }
1093
1094 if ( !(*dom_sids = TALLOC_ARRAY(mem_ctx, DOM_SID, count)) ) {
1095 DEBUG(0, ("trusted_domains: out of memory\n"));
1096 return NT_STATUS_NO_MEMORY;
1097 }
1098
1099 /* Copy across names and sids */
1100
1101 for (i = 0; i < count; i++) {
1102 (*names)[i] = domains[i].netbios_domain;
1103 (*alt_names)[i] = domains[i].dns_domain;
1104
1105 sid_copy(&(*dom_sids)[i], &domains[i].sid);
1106 }
1107
1108 *num_domains = count;
1109 }
1110
1111 return result;
1112 }
1113
1114 /* the ADS backend methods are exposed via this structure */
1115 struct winbindd_methods ads_methods = {
1116 True,
1117 query_user_list,
1118 enum_dom_groups,
1119 enum_local_groups,
1120 msrpc_name_to_sid,
1121 msrpc_sid_to_name,
1122 msrpc_rids_to_names,
1123 query_user,
1124 lookup_usergroups,
1125 msrpc_lookup_useraliases,
1126 lookup_groupmem,
1127 sequence_number,
1128 msrpc_lockout_policy,
1129 msrpc_password_policy,
1130 trusted_domains,
1131 };
1132
1133 #endif
Samba GIT mirror