2 * idmap_rid: static map between Active Directory/NT RIDs and RFC 2307 accounts
3 * Copyright (C) Guenther Deschner, 2004
4 * Copyright (C) Sumit Bose, 2004
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 #define DBGC_CLASS DBGC_IDMAP
28 struct idmap_rid_context
{
29 const char *domain_name
;
35 /******************************************************************************
36 compat params can't be used because of the completely different way
37 we support multiple domains in the new idmap
38 *****************************************************************************/
40 static NTSTATUS
idmap_rid_initialize(struct idmap_domain
*dom
, const char *compat_params
)
43 struct idmap_rid_context
*ctx
;
44 char *config_option
= NULL
;
47 if ( (ctx
= talloc_zero(dom
, struct idmap_rid_context
)) == NULL
) {
48 DEBUG(0, ("Out of memory!\n"));
49 return NT_STATUS_NO_MEMORY
;
52 config_option
= talloc_asprintf(ctx
, "idmap config %s", dom
->name
);
53 if ( ! config_option
) {
54 DEBUG(0, ("Out of memory!\n"));
55 ret
= NT_STATUS_NO_MEMORY
;
59 range
= lp_parm_const_string(-1, config_option
, "range", NULL
);
61 (sscanf(range
, "%u - %u", &ctx
->low_id
, &ctx
->high_id
) != 2) ||
62 (ctx
->low_id
> ctx
->high_id
))
68 if ( !ctx
->low_id
|| !ctx
->high_id
) {
69 DEBUG(1, ("ERROR: Invalid configuration, ID range missing\n"));
70 ret
= NT_STATUS_UNSUCCESSFUL
;
74 ctx
->base_rid
= lp_parm_int(-1, config_option
, "base_rid", 0);
75 ctx
->domain_name
= talloc_strdup( ctx
, dom
->name
);
77 dom
->private_data
= ctx
;
79 talloc_free(config_option
);
87 static NTSTATUS
idmap_rid_id_to_sid(TALLOC_CTX
*memctx
, struct idmap_rid_context
*ctx
, struct id_map
*map
)
89 const char *domname
, *name
;
90 enum lsa_SidType sid_type
;
92 struct winbindd_domain
*domain
;
94 /* apply filters before checking */
95 if ((map
->xid
.id
< ctx
->low_id
) || (map
->xid
.id
> ctx
->high_id
)) {
96 DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
97 map
->xid
.id
, ctx
->low_id
, ctx
->high_id
));
98 return NT_STATUS_NONE_MAPPED
;
101 if ( (domain
= find_domain_from_name_noinit(ctx
->domain_name
)) == NULL
) {
102 return NT_STATUS_NO_SUCH_DOMAIN
;
105 sid_compose(map
->sid
, &domain
->sid
, map
->xid
.id
- ctx
->low_id
+ ctx
->base_rid
);
107 /* by default calls to winbindd are disabled
108 the following call will not recurse so this is safe */
110 ret
= winbind_lookup_sid(memctx
, map
->sid
, &domname
, &name
, &sid_type
);
116 if (map
->xid
.type
!= ID_TYPE_UID
) {
118 map
->status
= ID_UNMAPPED
;
119 DEBUG(5, ("Resulting SID is of wrong ID type\n"));
120 return NT_STATUS_NONE_MAPPED
;
123 case SID_NAME_DOM_GRP
:
125 case SID_NAME_WKN_GRP
:
126 if (map
->xid
.type
!= ID_TYPE_GID
) {
128 map
->status
= ID_UNMAPPED
;
129 DEBUG(5, ("Resulting SID is of wrong ID type\n"));
130 return NT_STATUS_NONE_MAPPED
;
135 map
->status
= ID_UNKNOWN
;
136 DEBUG(10, ("SID %s is UNKNOWN, skip mapping\n", sid_string_static(map
->sid
)));
137 return NT_STATUS_NONE_MAPPED
;
140 /* TODO: how do we known if the lookup was negative
141 * or something just failed? */
142 map
->status
= ID_UNMAPPED
;
143 DEBUG(2, ("Failed: to resolve SID\n"));
144 return NT_STATUS_UNSUCCESSFUL
;
147 map
->status
= ID_MAPPED
;
152 /**********************************
153 Single sid to id lookup function.
154 **********************************/
156 static NTSTATUS
idmap_rid_sid_to_id(TALLOC_CTX
*memctx
, struct idmap_rid_context
*ctx
, struct id_map
*map
)
158 const char *domname
, *name
;
159 enum lsa_SidType sid_type
;
163 sid_peek_rid(map
->sid
, &rid
);
164 map
->xid
.id
= rid
- ctx
->base_rid
+ ctx
->low_id
;
166 /* by default calls to winbindd are disabled
167 the following call will not recurse so this is safe */
169 /* check if this is a valid SID and set the type */
170 ret
= winbind_lookup_sid(memctx
, map
->sid
, &domname
, &name
, &sid_type
);
176 map
->xid
.type
= ID_TYPE_UID
;
178 case SID_NAME_DOM_GRP
:
180 case SID_NAME_WKN_GRP
:
181 map
->xid
.type
= ID_TYPE_GID
;
184 /* invalid sid, let's just leave it unmapped */
185 DEBUG(10, ("SID %s is UNKNOWN, skip mapping\n", sid_string_static(map
->sid
)));
186 map
->status
= ID_UNKNOWN
;
187 return NT_STATUS_NONE_MAPPED
;
190 /* TODO: how do we known if the lookup was negative
191 * or something just failed? */
192 map
->status
= ID_UNMAPPED
;
193 DEBUG(2, ("Failed: to resolve SID\n"));
194 return NT_STATUS_UNSUCCESSFUL
;
197 /* apply filters before returning result */
198 if ((map
->xid
.id
< ctx
->low_id
) || (map
->xid
.id
> ctx
->high_id
)) {
199 DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
200 map
->xid
.id
, ctx
->low_id
, ctx
->high_id
));
201 map
->status
= ID_UNMAPPED
;
202 return NT_STATUS_NONE_MAPPED
;
205 map
->status
= ID_MAPPED
;
210 /**********************************
211 lookup a set of unix ids.
212 **********************************/
214 static NTSTATUS
idmap_rid_unixids_to_sids(struct idmap_domain
*dom
, struct id_map
**ids
)
216 struct idmap_rid_context
*ridctx
;
221 ridctx
= talloc_get_type(dom
->private_data
, struct idmap_rid_context
);
223 ctx
= talloc_new(dom
);
225 DEBUG(0, ("Out of memory!\n"));
226 return NT_STATUS_NO_MEMORY
;
229 for (i
= 0; ids
[i
]; i
++) {
231 ret
= idmap_rid_id_to_sid(ctx
, ridctx
, ids
[i
]);
233 if (( ! NT_STATUS_IS_OK(ret
)) &&
234 ( ! NT_STATUS_EQUAL(ret
, NT_STATUS_NONE_MAPPED
))) {
235 /* some fatal error occurred, log it */
236 DEBUG(3, ("Unexpected error resolving an ID (%d)\n", ids
[i
]->xid
.id
));
244 /**********************************
245 lookup a set of sids.
246 **********************************/
248 static NTSTATUS
idmap_rid_sids_to_unixids(struct idmap_domain
*dom
, struct id_map
**ids
)
250 struct idmap_rid_context
*ridctx
;
255 ridctx
= talloc_get_type(dom
->private_data
, struct idmap_rid_context
);
257 ctx
= talloc_new(dom
);
259 DEBUG(0, ("Out of memory!\n"));
260 return NT_STATUS_NO_MEMORY
;
263 for (i
= 0; ids
[i
]; i
++) {
265 ret
= idmap_rid_sid_to_id(ctx
, ridctx
, ids
[i
]);
267 if (( ! NT_STATUS_IS_OK(ret
)) &&
268 ( ! NT_STATUS_EQUAL(ret
, NT_STATUS_NONE_MAPPED
))) {
269 /* some fatal error occurred, log it */
270 DEBUG(3, ("Unexpected error resolving a SID (%s)\n",
271 sid_string_static(ids
[i
]->sid
)));
279 static NTSTATUS
idmap_rid_close(struct idmap_domain
*dom
)
281 if (dom
->private_data
) {
282 TALLOC_FREE(dom
->private_data
);
287 static struct idmap_methods rid_methods
= {
288 .init
= idmap_rid_initialize
,
289 .unixids_to_sids
= idmap_rid_unixids_to_sids
,
290 .sids_to_unixids
= idmap_rid_sids_to_unixids
,
291 .close_fn
= idmap_rid_close
294 NTSTATUS
idmap_rid_init(void)
296 return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION
, "rid", &rid_methods
);