2 Unix SMB/CIFS implementation.
4 Copyright (C) Simo Sorce 2003
5 Copyright (C) Jeremy Allison 2006
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.*/
22 #include "winbindd_proto.h"
24 #include "idmap_cache.h"
25 #include "../libcli/security/security.h"
28 #define DBGC_CLASS DBGC_IDMAP
30 /*****************************************************************
31 Returns the SID mapped to the given UID.
32 If mapping is not possible returns an error.
33 *****************************************************************/
35 NTSTATUS
idmap_uid_to_sid(const char *domname
, struct dom_sid
*sid
, uid_t uid
)
41 DEBUG(10,("idmap_uid_to_sid: uid = [%lu], domain = '%s'\n",
42 (unsigned long)uid
, domname
?domname
:"NULL"));
44 if (winbindd_use_idmap_cache()
45 && idmap_cache_find_uid2sid(uid
, sid
, &expired
)) {
46 DEBUG(10, ("idmap_cache_find_uid2sid found %u%s\n",
48 expired
? " (expired)": ""));
49 if (expired
&& idmap_is_online()) {
50 DEBUG(10, ("revalidating expired entry\n"));
53 if (is_null_sid(sid
)) {
54 DEBUG(10, ("Returning negative cache entry\n"));
55 return NT_STATUS_NONE_MAPPED
;
57 DEBUG(10, ("Returning positive cache entry\n"));
63 map
.xid
.type
= ID_TYPE_UID
;
66 ret
= idmap_backends_unixid_to_sid(domname
, &map
);
67 if ( ! NT_STATUS_IS_OK(ret
)) {
68 DEBUG(10, ("error mapping uid [%lu]\n", (unsigned long)uid
));
72 if (map
.status
!= ID_MAPPED
) {
73 if (winbindd_use_idmap_cache()) {
74 struct dom_sid null_sid
;
75 ZERO_STRUCT(null_sid
);
76 idmap_cache_set_sid2uid(&null_sid
, uid
);
78 DEBUG(10, ("uid [%lu] not mapped\n", (unsigned long)uid
));
79 return NT_STATUS_NONE_MAPPED
;
82 if (winbindd_use_idmap_cache()) {
83 idmap_cache_set_sid2uid(sid
, uid
);
89 /*****************************************************************
90 Returns SID mapped to the given GID.
91 If mapping is not possible returns an error.
92 *****************************************************************/
94 NTSTATUS
idmap_gid_to_sid(const char *domname
, struct dom_sid
*sid
, gid_t gid
)
100 DEBUG(10,("idmap_gid_to_sid: gid = [%lu], domain = '%s'\n",
101 (unsigned long)gid
, domname
?domname
:"NULL"));
103 if (winbindd_use_idmap_cache()
104 && idmap_cache_find_gid2sid(gid
, sid
, &expired
)) {
105 DEBUG(10, ("idmap_cache_find_gid2sid found %u%s\n",
107 expired
? " (expired)": ""));
108 if (expired
&& idmap_is_online()) {
109 DEBUG(10, ("revalidating expired entry\n"));
112 if (is_null_sid(sid
)) {
113 DEBUG(10, ("Returning negative cache entry\n"));
114 return NT_STATUS_NONE_MAPPED
;
116 DEBUG(10, ("Returning positive cache entry\n"));
122 map
.xid
.type
= ID_TYPE_GID
;
125 ret
= idmap_backends_unixid_to_sid(domname
, &map
);
126 if ( ! NT_STATUS_IS_OK(ret
)) {
127 DEBUG(10, ("error mapping gid [%lu]\n", (unsigned long)gid
));
131 if (map
.status
!= ID_MAPPED
) {
132 if (winbindd_use_idmap_cache()) {
133 struct dom_sid null_sid
;
134 ZERO_STRUCT(null_sid
);
135 idmap_cache_set_sid2uid(&null_sid
, gid
);
137 DEBUG(10, ("gid [%lu] not mapped\n", (unsigned long)gid
));
138 return NT_STATUS_NONE_MAPPED
;
141 if (winbindd_use_idmap_cache()) {
142 idmap_cache_set_sid2gid(sid
, gid
);
148 /*****************************************************************
149 Returns the UID mapped to the given SID.
150 If mapping is not possible or SID maps to a GID returns an error.
151 *****************************************************************/
153 NTSTATUS
idmap_sid_to_uid(const char *dom_name
, struct dom_sid
*sid
, uid_t
*uid
)
159 DEBUG(10,("idmap_sid_to_uid: sid = [%s], domain = '%s'\n",
160 sid_string_dbg(sid
), dom_name
));
162 if (winbindd_use_idmap_cache()
163 && idmap_cache_find_sid2uid(sid
, uid
, &expired
)) {
164 DEBUG(10, ("idmap_cache_find_sid2uid found %d%s\n",
165 (int)(*uid
), expired
? " (expired)": ""));
166 if (expired
&& idmap_is_online()) {
167 DEBUG(10, ("revalidating expired entry\n"));
171 DEBUG(10, ("Returning negative cache entry\n"));
172 return NT_STATUS_NONE_MAPPED
;
174 DEBUG(10, ("Returning positive cache entry\n"));
180 map
.xid
.type
= ID_TYPE_UID
;
182 ret
= idmap_backends_sid_to_unixid(dom_name
, &map
);
184 if (!NT_STATUS_IS_OK(ret
)) {
185 DEBUG(10, ("idmap_backends_sid_to_unixid failed: %s\n",
187 if (winbindd_use_idmap_cache()) {
188 idmap_cache_set_sid2uid(sid
, -1);
193 if (map
.status
!= ID_MAPPED
) {
194 DEBUG(10, ("sid [%s] is not mapped\n", sid_string_dbg(sid
)));
195 if (winbindd_use_idmap_cache()) {
196 idmap_cache_set_sid2uid(sid
, -1);
198 return NT_STATUS_NONE_MAPPED
;
201 if (map
.xid
.type
!= ID_TYPE_UID
) {
202 DEBUG(10, ("sid [%s] not mapped to a uid "
208 if (winbindd_use_idmap_cache()) {
209 idmap_cache_set_sid2uid(sid
, -1);
211 return NT_STATUS_NONE_MAPPED
;
214 *uid
= (uid_t
)map
.xid
.id
;
215 if (winbindd_use_idmap_cache()) {
216 idmap_cache_set_sid2uid(sid
, *uid
);
221 /*****************************************************************
222 Returns the GID mapped to the given SID.
223 If mapping is not possible or SID maps to a UID returns an error.
224 *****************************************************************/
226 NTSTATUS
idmap_sid_to_gid(const char *domname
, struct dom_sid
*sid
, gid_t
*gid
)
232 DEBUG(10,("idmap_sid_to_gid: sid = [%s], domain = '%s'\n",
233 sid_string_dbg(sid
), domname
));
235 if (winbindd_use_idmap_cache()
236 && idmap_cache_find_sid2gid(sid
, gid
, &expired
)) {
237 DEBUG(10, ("idmap_cache_find_sid2gid found %d%s\n",
238 (int)(*gid
), expired
? " (expired)": ""));
239 if (expired
&& idmap_is_online()) {
240 DEBUG(10, ("revalidating expired entry\n"));
244 DEBUG(10, ("Returning negative cache entry\n"));
245 return NT_STATUS_NONE_MAPPED
;
247 DEBUG(10, ("Returning positive cache entry\n"));
253 map
.xid
.type
= ID_TYPE_GID
;
255 ret
= idmap_backends_sid_to_unixid(domname
, &map
);
257 if (!NT_STATUS_IS_OK(ret
)) {
258 DEBUG(10, ("idmap_backends_sid_to_unixid failed: %s\n",
260 if (winbindd_use_idmap_cache()) {
261 idmap_cache_set_sid2uid(sid
, -1);
266 if (map
.status
!= ID_MAPPED
) {
267 DEBUG(10, ("sid [%s] is not mapped\n", sid_string_dbg(sid
)));
268 if (winbindd_use_idmap_cache()) {
269 idmap_cache_set_sid2uid(sid
, -1);
271 return NT_STATUS_NONE_MAPPED
;
274 if (map
.xid
.type
!= ID_TYPE_GID
) {
275 DEBUG(10, ("sid [%s] not mapped to a gid "
281 if (winbindd_use_idmap_cache()) {
282 idmap_cache_set_sid2gid(sid
, -1);
284 return NT_STATUS_NONE_MAPPED
;
288 if (winbindd_use_idmap_cache()) {
289 idmap_cache_set_sid2gid(sid
, *gid
);
295 * check whether a given unix id is inside the filter range of an idmap domain
297 bool idmap_unix_id_is_in_range(uint32_t id
, struct idmap_domain
*dom
)
300 /* 0 is not an allowed unix id for id mapping */
304 if ((dom
->low_id
&& (id
< dom
->low_id
)) ||
305 (dom
->high_id
&& (id
> dom
->high_id
)))