2 Unix SMB/CIFS implementation.
4 Copyright (C) Tim Potter 2000
5 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
6 Copyright (C) Simo Sorce 2003
7 Copyright (C) Jeremy Allison 2006
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
28 #define DBGC_CLASS DBGC_IDMAP
32 struct idmap_backend
{
34 struct idmap_methods
*methods
;
35 struct idmap_backend
*prev
, *next
;
38 struct idmap_alloc_backend
{
40 struct idmap_alloc_methods
*methods
;
41 struct idmap_alloc_backend
*prev
, *next
;
44 struct idmap_cache_ctx
;
46 static TALLOC_CTX
*idmap_ctx
= NULL
;
47 static struct idmap_cache_ctx
*idmap_cache
;
49 static struct idmap_backend
*backends
= NULL
;
50 static struct idmap_domain
**idmap_domains
= NULL
;
51 static int num_domains
= 0;
52 static int pdb_dom_num
= -1;
53 static int def_dom_num
= -1;
55 static struct idmap_alloc_backend
*alloc_backends
= NULL
;
56 static struct idmap_alloc_methods
*alloc_methods
= NULL
;
58 #define IDMAP_CHECK_RET(ret) do { if ( ! NT_STATUS_IS_OK(ret)) { DEBUG(2, ("ERROR: NTSTATUS = 0x%08x\n", NT_STATUS_V(ret))); goto done; } } while(0)
59 #define IDMAP_CHECK_ALLOC(mem) do { if (!mem) { DEBUG(0, ("Out of memory!\n")); ret = NT_STATUS_NO_MEMORY; goto done; } } while(0)
61 static struct idmap_methods
*get_methods(struct idmap_backend
*be
, const char *name
)
63 struct idmap_backend
*b
;
65 for (b
= be
; b
; b
= b
->next
) {
66 if (strequal(b
->name
, name
)) {
74 static struct idmap_alloc_methods
*get_alloc_methods(struct idmap_alloc_backend
*be
, const char *name
)
76 struct idmap_alloc_backend
*b
;
78 for (b
= be
; b
; b
= b
->next
) {
79 if (strequal(b
->name
, name
)) {
87 /**********************************************************************
88 Allow a module to register itself as a method.
89 **********************************************************************/
91 NTSTATUS
smb_register_idmap(int version
, const char *name
, struct idmap_methods
*methods
)
93 struct idmap_methods
*test
;
94 struct idmap_backend
*entry
;
97 return NT_STATUS_INTERNAL_DB_ERROR
;
100 if ((version
!= SMB_IDMAP_INTERFACE_VERSION
)) {
101 DEBUG(0, ("Failed to register idmap module.\n"
102 "The module was compiled against SMB_IDMAP_INTERFACE_VERSION %d,\n"
103 "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
104 "Please recompile against the current version of samba!\n",
105 version
, SMB_IDMAP_INTERFACE_VERSION
));
106 return NT_STATUS_OBJECT_TYPE_MISMATCH
;
109 if (!name
|| !name
[0] || !methods
) {
110 DEBUG(0,("Called with NULL pointer or empty name!\n"));
111 return NT_STATUS_INVALID_PARAMETER
;
114 test
= get_methods(backends
, name
);
116 DEBUG(0,("Idmap module %s already registered!\n", name
));
117 return NT_STATUS_OBJECT_NAME_COLLISION
;
120 entry
= talloc(idmap_ctx
, struct idmap_backend
);
122 DEBUG(0,("Out of memory!\n"));
123 return NT_STATUS_NO_MEMORY
;
125 entry
->name
= talloc_strdup(idmap_ctx
, name
);
126 if ( ! entry
->name
) {
127 DEBUG(0,("Out of memory!\n"));
128 return NT_STATUS_NO_MEMORY
;
130 entry
->methods
= methods
;
132 DLIST_ADD(backends
, entry
);
133 DEBUG(5, ("Successfully added idmap backend '%s'\n", name
));
137 /**********************************************************************
138 Allow a module to register itself as a method.
139 **********************************************************************/
141 NTSTATUS
smb_register_idmap_alloc(int version
, const char *name
, struct idmap_alloc_methods
*methods
)
143 struct idmap_alloc_methods
*test
;
144 struct idmap_alloc_backend
*entry
;
147 return NT_STATUS_INTERNAL_DB_ERROR
;
150 if ((version
!= SMB_IDMAP_INTERFACE_VERSION
)) {
151 DEBUG(0, ("Failed to register idmap alloc module.\n"
152 "The module was compiled against SMB_IDMAP_INTERFACE_VERSION %d,\n"
153 "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
154 "Please recompile against the current version of samba!\n",
155 version
, SMB_IDMAP_INTERFACE_VERSION
));
156 return NT_STATUS_OBJECT_TYPE_MISMATCH
;
159 if (!name
|| !name
[0] || !methods
) {
160 DEBUG(0,("Called with NULL pointer or empty name!\n"));
161 return NT_STATUS_INVALID_PARAMETER
;
164 test
= get_alloc_methods(alloc_backends
, name
);
166 DEBUG(0,("idmap_alloc module %s already registered!\n", name
));
167 return NT_STATUS_OBJECT_NAME_COLLISION
;
170 entry
= talloc(idmap_ctx
, struct idmap_alloc_backend
);
172 DEBUG(0,("Out of memory!\n"));
173 return NT_STATUS_NO_MEMORY
;
175 entry
->name
= talloc_strdup(idmap_ctx
, name
);
176 if ( ! entry
->name
) {
177 DEBUG(0,("Out of memory!\n"));
178 return NT_STATUS_NO_MEMORY
;
180 entry
->methods
= methods
;
182 DLIST_ADD(alloc_backends
, entry
);
183 DEBUG(5, ("Successfully added idmap alloc backend '%s'\n", name
));
187 static int close_domain_destructor(struct idmap_domain
*dom
)
191 ret
= dom
->methods
->close_fn(dom
);
192 if (!NT_STATUS_IS_OK(ret
)) {
193 DEBUG(3, ("Failed to close idmap domain [%s]!\n", dom
->name
));
199 /**************************************************************************
201 **************************************************************************/
203 NTSTATUS
idmap_close(void)
205 /* close the alloc backend first before freeing idmap_ctx */
207 alloc_methods
->close_fn();
208 alloc_methods
= NULL
;
210 alloc_backends
= NULL
;
212 /* this talloc_free call will fire the talloc destructors
213 * that will free all active backends resources */
214 TALLOC_FREE(idmap_ctx
);
216 idmap_domains
= NULL
;
222 /**********************************************************************
223 Initialise idmap cache and a remote backend (if configured).
224 **********************************************************************/
226 static const char *idmap_default_domain
[] = { "default domain", NULL
};
228 NTSTATUS
idmap_init(void)
231 struct idmap_domain
*dom
;
232 char *compat_backend
= NULL
;
233 char *compat_params
= NULL
;
234 const char **dom_list
= NULL
;
236 BOOL default_already_defined
= False
;
237 BOOL pri_dom_is_in_list
= False
;
245 if ( (idmap_ctx
= talloc_named_const(NULL
, 0, "idmap_ctx")) == NULL
) {
246 return NT_STATUS_NO_MEMORY
;
249 if ( (idmap_cache
= idmap_cache_init(idmap_ctx
)) == NULL
) {
250 return NT_STATUS_UNSUCCESSFUL
;
255 dom_list
= lp_idmap_domains();
257 if ( dom_list
&& lp_idmap_backend() ) {
258 DEBUG(0, ("WARNING: idmap backend and idmap domains are "
259 "mutually excusive!\n"));
260 DEBUGADD(0,("idmap backend option will be IGNORED!\n"));
261 } else if ( lp_idmap_backend() ) {
262 const char **compat_list
= lp_idmap_backend();
264 const char *q
= NULL
;
266 DEBUG(0, ("WARNING: idmap backend is deprecated!\n"));
269 if ( (compat_backend
= talloc_strdup( idmap_ctx
, *compat_list
)) == NULL
) {
270 ret
= NT_STATUS_NO_MEMORY
;
274 /* strip any leading idmap_ prefix of */
275 if (strncmp(*compat_list
, "idmap_", 6) == 0 ) {
276 q
= *compat_list
+= 6;
277 DEBUG(0, ("WARNING: idmap backend uses obsolete and "
278 "deprecated 'idmap_' prefix.\n"
279 "Please replace 'idmap_%s' by '%s' in %s\n",
280 q
, q
, dyn_CONFIGFILE
));
281 compat_backend
= talloc_strdup( idmap_ctx
, q
);
283 compat_backend
= talloc_strdup( idmap_ctx
, *compat_list
);
286 /* separate the backend and module arguements */
287 if ((p
= strchr(compat_backend
, ':')) != NULL
) {
289 compat_params
= p
+ 1;
294 dom_list
= idmap_default_domain
;
297 /***************************
298 * initialize idmap domains
300 DEBUG(1, ("Initializing idmap domains\n"));
302 for (i
= 0; dom_list
[i
]; i
++) {
303 const char *parm_backend
;
306 if (strequal(dom_list
[i
], lp_workgroup())) {
307 pri_dom_is_in_list
= True
;
311 dom
= talloc_zero(idmap_ctx
, struct idmap_domain
);
312 IDMAP_CHECK_ALLOC(dom
);
314 dom
->name
= talloc_strdup(dom
, dom_list
[i
]);
315 IDMAP_CHECK_ALLOC(dom
->name
);
317 config_option
= talloc_asprintf(dom
, "idmap config %s", dom
->name
);
318 IDMAP_CHECK_ALLOC(config_option
);
320 /* default or specific ? */
322 dom
->default_domain
= lp_parm_bool(-1, config_option
, "default", False
);
324 if (dom
->default_domain
||
325 strequal(dom_list
[i
], idmap_default_domain
[0])) {
327 /* make sure this is set even when we match idmap_default_domain[0] */
328 dom
->default_domain
= True
;
330 if (default_already_defined
) {
331 DEBUG(1, ("ERROR: Multiple domains defined as default!\n"));
332 ret
= NT_STATUS_INVALID_PARAMETER
;
336 default_already_defined
= True
;
340 dom
->readonly
= lp_parm_bool(-1, config_option
, "readonly", False
);
342 /* find associated backend (default: tdb) */
344 parm_backend
= talloc_strdup(idmap_ctx
, compat_backend
);
346 parm_backend
= talloc_strdup(idmap_ctx
,
347 lp_parm_const_string(-1, config_option
, "backend", "tdb"));
349 IDMAP_CHECK_ALLOC(parm_backend
);
351 /* get the backend methods for this domain */
352 dom
->methods
= get_methods(backends
, parm_backend
);
354 if ( ! dom
->methods
) {
355 ret
= smb_probe_module("idmap", parm_backend
);
356 if (NT_STATUS_IS_OK(ret
)) {
357 dom
->methods
= get_methods(backends
, parm_backend
);
360 if ( ! dom
->methods
) {
361 DEBUG(0, ("ERROR: Could not get methods for backend %s\n", parm_backend
));
362 ret
= NT_STATUS_UNSUCCESSFUL
;
366 /* check the set_mapping function exists otherwise mark the module as readonly */
367 if ( ! dom
->methods
->set_mapping
) {
368 dom
->readonly
= True
;
371 /* now that we have methods, set the destructor for this domain */
372 talloc_set_destructor(dom
, close_domain_destructor
);
374 /* Finally instance a backend copy for this domain */
375 ret
= dom
->methods
->init(dom
, compat_params
);
376 if ( ! NT_STATUS_IS_OK(ret
)) {
377 DEBUG(0, ("ERROR: Initialization failed for backend %s (domain %s)\n",
378 parm_backend
, dom
->name
));
379 ret
= NT_STATUS_UNSUCCESSFUL
;
382 idmap_domains
= talloc_realloc(idmap_ctx
, idmap_domains
, struct idmap_domain
*, i
+1);
383 if ( ! idmap_domains
) {
384 DEBUG(0, ("Out of memory!\n"));
385 ret
= NT_STATUS_NO_MEMORY
;
388 idmap_domains
[i
] = dom
;
390 if (dom
->default_domain
) { /* save default domain position for future uses */
394 DEBUG(10, ("Domain %s - Backend %s - %sdefault - %sreadonly\n",
395 dom
->name
, parm_backend
,
396 dom
->default_domain
?"":"not ", dom
->readonly
?"":"not "));
398 talloc_free(config_option
);
401 /* save the number of domains we have */
404 /* automatically add idmap_nss backend if needed */
405 if ((lp_server_role() == ROLE_DOMAIN_MEMBER
) &&
406 ( ! pri_dom_is_in_list
) &&
407 lp_winbind_trusted_domains_only()) {
409 dom
= talloc_zero(idmap_ctx
, struct idmap_domain
);
410 IDMAP_CHECK_ALLOC(dom
);
412 dom
->name
= talloc_strdup(dom
, lp_workgroup());
413 IDMAP_CHECK_ALLOC(dom
->name
);
415 dom
->default_domain
= False
;
416 dom
->readonly
= True
;
418 /* get the backend methods for passdb */
419 dom
->methods
= get_methods(backends
, "nss");
421 /* (the nss module is always statically linked) */
422 if ( ! dom
->methods
) {
423 DEBUG(0, ("ERROR: Could not get methods for idmap_nss ?!\n"));
424 ret
= NT_STATUS_UNSUCCESSFUL
;
428 /* now that we have methods, set the destructor for this domain */
429 talloc_set_destructor(dom
, close_domain_destructor
);
431 /* Finally instance a backend copy for this domain */
432 ret
= dom
->methods
->init(dom
, compat_params
);
433 if ( ! NT_STATUS_IS_OK(ret
)) {
434 DEBUG(0, ("ERROR: Initialization failed for idmap_nss ?!\n"));
435 ret
= NT_STATUS_UNSUCCESSFUL
;
439 idmap_domains
= talloc_realloc(idmap_ctx
, idmap_domains
, struct idmap_domain
*, num_domains
+1);
440 if ( ! idmap_domains
) {
441 DEBUG(0, ("Out of memory!\n"));
442 ret
= NT_STATUS_NO_MEMORY
;
445 idmap_domains
[num_domains
] = dom
;
447 DEBUG(10, ("Domain %s - Backend nss - not default - readonly\n", dom
->name
));
452 /**** automatically add idmap_passdb backend ****/
453 dom
= talloc_zero(idmap_ctx
, struct idmap_domain
);
454 IDMAP_CHECK_ALLOC(dom
);
456 dom
->name
= talloc_strdup(dom
, get_global_sam_name());
457 IDMAP_CHECK_ALLOC(dom
->name
);
459 dom
->default_domain
= False
;
460 dom
->readonly
= True
;
462 /* get the backend methods for passdb */
463 dom
->methods
= get_methods(backends
, "passdb");
465 /* (the passdb module is always statically linked) */
466 if ( ! dom
->methods
) {
467 DEBUG(0, ("ERROR: Could not get methods for idmap_passdb ?!\n"));
468 ret
= NT_STATUS_UNSUCCESSFUL
;
472 /* now that we have methods, set the destructor for this domain */
473 talloc_set_destructor(dom
, close_domain_destructor
);
475 /* Finally instance a backend copy for this domain */
476 ret
= dom
->methods
->init(dom
, compat_params
);
477 if ( ! NT_STATUS_IS_OK(ret
)) {
478 DEBUG(0, ("ERROR: Initialization failed for idmap_passdb ?!\n"));
479 ret
= NT_STATUS_UNSUCCESSFUL
;
483 idmap_domains
= talloc_realloc(idmap_ctx
, idmap_domains
, struct idmap_domain
*, num_domains
+1);
484 if ( ! idmap_domains
) {
485 DEBUG(0, ("Out of memory!\n"));
486 ret
= NT_STATUS_NO_MEMORY
;
489 idmap_domains
[num_domains
] = dom
;
491 /* needed to handle special BUILTIN and wellknown SIDs cases */
492 pdb_dom_num
= num_domains
;
494 DEBUG(10, ("Domain %s - Backend passdb - not default - readonly\n", dom
->name
));
497 /**** finished adding idmap_passdb backend ****/
499 /* sort domains so that the default is the last one */
500 if (def_dom_num
!= num_domains
-1) { /* default is not last, move it */
501 struct idmap_domain
*tmp
;
503 if (pdb_dom_num
> def_dom_num
) {
506 } else if (pdb_dom_num
== def_dom_num
) { /* ?? */
507 pdb_dom_num
= num_domains
- 1;
510 tmp
= idmap_domains
[def_dom_num
];
512 for (i
= def_dom_num
; i
< num_domains
-1; i
++) {
513 idmap_domains
[i
] = idmap_domains
[i
+1];
515 idmap_domains
[i
] = tmp
;
520 /***************************
521 * initialize alloc module
523 DEBUG(1, ("Initializing idmap alloc module\n"));
526 alloc_backend
= talloc_strdup(idmap_ctx
, compat_backend
);
528 char *ab
= lp_idmap_alloc_backend();
530 if (ab
&& (ab
[0] != '\0')) {
531 alloc_backend
= talloc_strdup(idmap_ctx
, lp_idmap_alloc_backend());
533 alloc_backend
= talloc_strdup(idmap_ctx
, "tdb");
536 IDMAP_CHECK_ALLOC(alloc_backend
);
538 alloc_methods
= get_alloc_methods(alloc_backends
, alloc_backend
);
539 if ( ! alloc_methods
) {
540 ret
= smb_probe_module("idmap", alloc_backend
);
541 if (NT_STATUS_IS_OK(ret
)) {
542 alloc_methods
= get_alloc_methods(alloc_backends
, alloc_backend
);
545 if ( ! alloc_methods
) {
546 DEBUG(0, ("ERROR: Could not get methods for alloc backend %s\n", alloc_backend
));
547 ret
= NT_STATUS_UNSUCCESSFUL
;
551 ret
= alloc_methods
->init(compat_params
);
552 if ( ! NT_STATUS_IS_OK(ret
)) {
553 DEBUG(0, ("ERROR: Initialization failed for alloc backend %s\n", alloc_backend
));
554 ret
= NT_STATUS_UNSUCCESSFUL
;
558 /* cleanpu temporary strings */
559 TALLOC_FREE( compat_backend
);
564 DEBUG(0, ("Aborting IDMAP Initialization ...\n"));
569 /**************************************************************************
570 idmap allocator interface functions
571 **************************************************************************/
573 NTSTATUS
idmap_allocate_uid(struct unixid
*id
)
577 if (! NT_STATUS_IS_OK(ret
= idmap_init())) {
581 id
->type
= ID_TYPE_UID
;
582 return alloc_methods
->allocate_id(id
);
585 NTSTATUS
idmap_allocate_gid(struct unixid
*id
)
589 if (! NT_STATUS_IS_OK(ret
= idmap_init())) {
593 id
->type
= ID_TYPE_GID
;
594 return alloc_methods
->allocate_id(id
);
597 NTSTATUS
idmap_set_uid_hwm(struct unixid
*id
)
601 if (! NT_STATUS_IS_OK(ret
= idmap_init())) {
605 id
->type
= ID_TYPE_UID
;
606 return alloc_methods
->set_id_hwm(id
);
609 NTSTATUS
idmap_set_gid_hwm(struct unixid
*id
)
613 if (! NT_STATUS_IS_OK(ret
= idmap_init())) {
617 id
->type
= ID_TYPE_GID
;
618 return alloc_methods
->set_id_hwm(id
);
621 /******************************************************************************
622 Lookup an idmap_domain give a full user or group SID
623 ******************************************************************************/
625 static struct idmap_domain
* find_idmap_domain_from_sid( DOM_SID
*account_sid
)
629 struct winbindd_domain
*domain
= NULL
;
632 /* 1. Handle BUILTIN or Special SIDs and prevent them from
633 falling into the default domain space (if we have a
634 configured passdb backend. */
636 if ( (pdb_dom_num
!= -1) &&
637 (sid_check_is_in_builtin(account_sid
) ||
638 sid_check_is_in_wellknown_domain(account_sid
)) )
640 return idmap_domains
[pdb_dom_num
];
643 /* 2. Lookup the winbindd_domain from the account_sid */
645 sid_copy( &domain_sid
, account_sid
);
646 sid_split_rid( &domain_sid
, &rid
);
647 domain
= find_domain_from_sid_noinit( &domain_sid
);
649 for (i
= 0; domain
&& i
< num_domains
; i
++) {
650 if ( strequal( idmap_domains
[i
]->name
, domain
->name
) ) {
651 return idmap_domains
[i
];
655 /* 3. Fall back to the default domain */
657 if ( def_dom_num
!= -1 ) {
658 return idmap_domains
[def_dom_num
];
664 /******************************************************************************
665 Lookup an index given an idmap_domain pointer
666 ******************************************************************************/
668 static uint32
find_idmap_domain_index( struct idmap_domain
*id_domain
)
672 for (i
= 0; i
< num_domains
; i
++) {
673 if ( idmap_domains
[i
] == id_domain
)
681 /*********************************************************
682 Check if creating a mapping is permitted for the domain
683 *********************************************************/
685 static NTSTATUS
idmap_can_map(const struct id_map
*map
, struct idmap_domain
**ret_dom
)
687 struct idmap_domain
*dom
;
689 /* Check we do not create mappings for our own local domain, or BUILTIN or special SIDs */
690 if ((sid_compare_domain(map
->sid
, get_global_sam_sid()) == 0) ||
691 sid_check_is_in_builtin(map
->sid
) ||
692 sid_check_is_in_wellknown_domain(map
->sid
)) {
693 DEBUG(10, ("We are not supposed to create mappings for our own domains (local, builtin, specials)\n"));
694 return NT_STATUS_UNSUCCESSFUL
;
697 /* Special check for trusted domain only = Yes */
698 if (lp_winbind_trusted_domains_only()) {
699 struct winbindd_domain
*wdom
= find_our_domain();
700 if (wdom
&& (sid_compare_domain(map
->sid
, &wdom
->sid
) == 0)) {
701 DEBUG(10, ("We are not supposed to create mappings for our primary domain when <trusted domain only> is True\n"));
702 DEBUGADD(10, ("Leave [%s] unmapped\n", sid_string_static(map
->sid
)));
703 return NT_STATUS_UNSUCCESSFUL
;
707 if ( (dom
= find_idmap_domain_from_sid( map
->sid
)) == NULL
) {
708 /* huh, couldn't find a suitable domain, let's just leave it unmapped */
709 DEBUG(10, ("Could not find idmap backend for SID %s", sid_string_static(map
->sid
)));
710 return NT_STATUS_NO_SUCH_DOMAIN
;
714 /* ouch the domain is read only, let's just leave it unmapped */
715 DEBUG(10, ("idmap backend for SID %s is READONLY!\n", sid_string_static(map
->sid
)));
716 return NT_STATUS_UNSUCCESSFUL
;
723 static NTSTATUS
idmap_new_mapping(TALLOC_CTX
*ctx
, struct id_map
*map
)
726 struct idmap_domain
*dom
;
727 const char *domname
, *name
;
728 enum lsa_SidType sid_type
;
731 ret
= idmap_can_map(map
, &dom
);
732 if ( ! NT_STATUS_IS_OK(ret
)) {
733 return NT_STATUS_NONE_MAPPED
;
736 /* by default calls to winbindd are disabled
737 the following call will not recurse so this is safe */
739 wbret
= winbind_lookup_sid(ctx
, map
->sid
, &domname
, &name
, &sid_type
);
742 /* check if this is a valid SID and then map it */
746 ret
= idmap_allocate_uid(&map
->xid
);
747 if ( ! NT_STATUS_IS_OK(ret
)) {
748 /* can't allocate id, let's just leave it unmapped */
749 DEBUG(2, ("uid allocation failed! Can't create mapping\n"));
750 return NT_STATUS_NONE_MAPPED
;
753 case SID_NAME_DOM_GRP
:
755 case SID_NAME_WKN_GRP
:
756 ret
= idmap_allocate_gid(&map
->xid
);
757 if ( ! NT_STATUS_IS_OK(ret
)) {
758 /* can't allocate id, let's just leave it unmapped */
759 DEBUG(2, ("gid allocation failed! Can't create mapping\n"));
760 return NT_STATUS_NONE_MAPPED
;
764 /* invalid sid, let's just leave it unmapped */
765 DEBUG(10, ("SID %s is UNKNOWN, skip mapping\n", sid_string_static(map
->sid
)));
766 return NT_STATUS_NONE_MAPPED
;
769 /* ok, got a new id, let's set a mapping */
770 map
->status
= ID_MAPPED
;
772 DEBUG(10, ("Setting mapping: %s <-> %s %lu\n",
773 sid_string_static(map
->sid
),
774 (map
->xid
.type
== ID_TYPE_UID
) ? "UID" : "GID",
775 (unsigned long)map
->xid
.id
));
776 ret
= dom
->methods
->set_mapping(dom
, map
);
778 if ( ! NT_STATUS_IS_OK(ret
)) {
779 /* something wrong here :-( */
780 DEBUG(2, ("Failed to commit mapping\n!"));
782 /* TODO: would it make sense to have an "unalloc_id function?" */
784 return NT_STATUS_NONE_MAPPED
;
787 DEBUG(2,("Invalid SID, not mapping %s (type %d)\n",
788 sid_string_static(map
->sid
), sid_type
));
789 return NT_STATUS_NONE_MAPPED
;
795 static NTSTATUS
idmap_backends_set_mapping(const struct id_map
*map
)
797 struct idmap_domain
*dom
;
800 DEBUG(10, ("Setting mapping %s <-> %s %lu\n",
801 sid_string_static(map
->sid
),
802 (map
->xid
.type
== ID_TYPE_UID
) ? "UID" : "GID",
803 (unsigned long)map
->xid
.id
));
805 ret
= idmap_can_map(map
, &dom
);
806 if ( ! NT_STATUS_IS_OK(ret
)) {
810 DEBUG(10,("set_mapping for domain %s\n", dom
->name
));
812 return dom
->methods
->set_mapping(dom
, map
);
815 static NTSTATUS
idmap_backends_unixids_to_sids(struct id_map
**ids
)
817 struct idmap_domain
*dom
;
818 struct id_map
**unmapped
;
819 struct id_map
**_ids
;
825 DEBUG(1, ("Invalid list of maps\n"));
826 return NT_STATUS_INVALID_PARAMETER
;
829 ctx
= talloc_named_const(NULL
, 0, "idmap_backends_unixids_to_sids ctx");
831 DEBUG(0, ("Out of memory!\n"));
832 return NT_STATUS_NO_MEMORY
;
835 DEBUG(10, ("Query backends to map ids->sids\n"));
837 /* start from the default (the last one) and then if there are still
838 * unmapped entries cycle through the others */
842 /* make sure all maps are marked as in UNKNOWN status */
843 for (i
= 0; _ids
[i
]; i
++) {
844 _ids
[i
]->status
= ID_UNKNOWN
;
848 for (n
= num_domains
-1; n
>= 0; n
--) { /* cycle backwards */
850 dom
= idmap_domains
[n
];
852 DEBUG(10, ("Query sids from domain %s\n", dom
->name
));
854 ret
= dom
->methods
->unixids_to_sids(dom
, _ids
);
855 IDMAP_CHECK_RET(ret
);
859 for (i
= 0, u
= 0; _ids
[i
]; i
++) {
860 if (_ids
[i
]->status
== ID_UNKNOWN
|| _ids
[i
]->status
== ID_UNMAPPED
) {
861 unmapped
= talloc_realloc(ctx
, unmapped
, struct id_map
*, u
+ 2);
862 IDMAP_CHECK_ALLOC(unmapped
);
863 unmapped
[u
] = _ids
[i
];
868 /* terminate the unmapped list */
870 } else { /* no more entries, get out */
879 /* there are still unmapped ids, map them to the unix users/groups domains */
880 for (i
= 0; unmapped
[i
]; i
++) {
881 switch (unmapped
[i
]->xid
.type
) {
883 uid_to_unix_users_sid((uid_t
)unmapped
[i
]->xid
.id
, unmapped
[i
]->sid
);
884 unmapped
[i
]->status
= ID_MAPPED
;
887 gid_to_unix_groups_sid((gid_t
)unmapped
[i
]->xid
.id
, unmapped
[i
]->sid
);
888 unmapped
[i
]->status
= ID_MAPPED
;
890 default: /* what?! */
891 unmapped
[i
]->status
= ID_UNKNOWN
;
904 static NTSTATUS
idmap_backends_sids_to_unixids(struct id_map
**ids
)
906 struct id_map
***dom_ids
;
907 struct idmap_domain
*dom
;
912 if ( (ctx
= talloc_named_const(NULL
, 0, "be_sids_to_ids")) == NULL
) {
913 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
914 return NT_STATUS_NO_MEMORY
;
917 DEBUG(10, ("Query backends to map sids->ids\n"));
919 /* split list per domain */
921 dom_ids
= talloc_zero_array(ctx
, struct id_map
**, num_domains
);
922 IDMAP_CHECK_ALLOC(dom_ids
);
923 counters
= talloc_zero_array(ctx
, int, num_domains
);
925 /* partition the requests by domain */
927 for (i
= 0; ids
[i
]; i
++) {
930 /* make sure they are unknown to start off */
931 ids
[i
]->status
= ID_UNKNOWN
;
933 if ( (dom
= find_idmap_domain_from_sid( ids
[i
]->sid
)) == NULL
) {
934 /* no vailable idmap_domain. Move on */
938 DEBUG(10,("SID %s is being handled by %s\n",
939 sid_string_static(ids
[i
]->sid
),
940 dom
? dom
->name
: "none" ));
942 idx
= find_idmap_domain_index( dom
);
943 SMB_ASSERT( idx
!= -1 );
945 dom_ids
[idx
] = talloc_realloc(ctx
, dom_ids
[idx
],
946 struct id_map
*, counters
[idx
] + 2);
947 IDMAP_CHECK_ALLOC(dom_ids
[idx
]);
949 dom_ids
[idx
][counters
[idx
]] = ids
[i
];
951 dom_ids
[idx
][counters
[idx
]] = NULL
;
954 /* All the ids have been dispatched in the right queues.
955 Let's cycle through the filled ones */
957 for (i
= 0; i
< num_domains
; i
++) {
959 dom
= idmap_domains
[i
];
960 DEBUG(10, ("Query ids from domain %s\n", dom
->name
));
961 ret
= dom
->methods
->sids_to_unixids(dom
, dom_ids
[i
]);
962 IDMAP_CHECK_RET(ret
);
966 /* ok all the backends have been contacted at this point */
967 /* let's see if we have any unmapped SID left and act accordingly */
969 for (i
= 0; ids
[i
]; i
++) {
970 if (ids
[i
]->status
== ID_UNKNOWN
|| ids
[i
]->status
== ID_UNMAPPED
) {
971 /* ok this is an unmapped one, see if we can map it */
972 ret
= idmap_new_mapping(ctx
, ids
[i
]);
973 if (NT_STATUS_IS_OK(ret
)) {
974 /* successfully mapped */
975 ids
[i
]->status
= ID_MAPPED
;
976 } else if (NT_STATUS_EQUAL(ret
, NT_STATUS_NONE_MAPPED
)) {
977 /* could not map it */
978 ids
[i
]->status
= ID_UNMAPPED
;
980 /* Something very bad happened down there */
981 ids
[i
]->status
= ID_UNKNOWN
;
993 /**************************************************************************
994 idmap interface functions
995 **************************************************************************/
997 NTSTATUS
idmap_unixids_to_sids(struct id_map
**ids
)
1001 struct id_map
**bids
;
1005 if (! NT_STATUS_IS_OK(ret
= idmap_init())) {
1009 if (!ids
|| !*ids
) {
1010 DEBUG(1, ("Invalid list of maps\n"));
1011 return NT_STATUS_INVALID_PARAMETER
;
1014 ctx
= talloc_named_const(NULL
, 0, "idmap_unixids_to_sids ctx");
1016 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1017 return NT_STATUS_NO_MEMORY
;
1020 /* no ids to be asked to the backends by default */
1024 for (i
= 0; ids
[i
]; i
++) {
1026 if ( ! ids
[i
]->sid
) {
1027 DEBUG(1, ("invalid null SID in id_map array"));
1029 return NT_STATUS_INVALID_PARAMETER
;
1032 ret
= idmap_cache_map_id(idmap_cache
, ids
[i
]);
1034 if ( ! NT_STATUS_IS_OK(ret
)) {
1037 /* alloc space for ids to be resolved by backends (realloc ten by ten) */
1038 bids
= talloc_array(ctx
, struct id_map
*, 10);
1040 DEBUG(1, ("Out of memory!\n"));
1042 return NT_STATUS_NO_MEMORY
;
1047 /* add this id to the ones to be retrieved from the backends */
1051 /* check if we need to allocate new space on the rids array */
1054 bids
= talloc_realloc(ctx
, bids
, struct id_map
*, bn
);
1056 DEBUG(1, ("Out of memory!\n"));
1058 return NT_STATUS_NO_MEMORY
;
1062 /* make sure the last element is NULL */
1067 /* let's see if there is any id mapping to be retieved from the backends */
1069 ret
= idmap_backends_unixids_to_sids(bids
);
1070 IDMAP_CHECK_RET(ret
);
1072 /* update the cache */
1073 for (i
= 0; i
< bi
; i
++) {
1074 if (bids
[i
]->status
== ID_MAPPED
) {
1075 ret
= idmap_cache_set(idmap_cache
, bids
[i
]);
1076 } else if (bids
[i
]->status
== ID_UNKNOWN
) {
1077 /* return an expired entry in the cache or an unknown */
1078 /* this handles a previous NT_STATUS_SYNCHRONIZATION_REQUIRED
1079 * for disconnected mode */
1080 idmap_cache_map_id(idmap_cache
, ids
[i
]);
1081 } else { /* unmapped */
1082 ret
= idmap_cache_set_negative_id(idmap_cache
, bids
[i
]);
1084 IDMAP_CHECK_RET(ret
);
1094 NTSTATUS
idmap_sids_to_unixids(struct id_map
**ids
)
1098 struct id_map
**bids
;
1102 if (! NT_STATUS_IS_OK(ret
= idmap_init())) {
1106 if (!ids
|| !*ids
) {
1107 DEBUG(1, ("Invalid list of maps\n"));
1108 return NT_STATUS_INVALID_PARAMETER
;
1111 ctx
= talloc_named_const(NULL
, 0, "idmap_sids_to_unixids ctx");
1113 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1114 return NT_STATUS_NO_MEMORY
;
1117 /* no ids to be asked to the backends by default */
1121 for (i
= 0; ids
[i
]; i
++) {
1123 if ( ! ids
[i
]->sid
) {
1124 DEBUG(1, ("invalid null SID in id_map array\n"));
1126 return NT_STATUS_INVALID_PARAMETER
;
1129 ret
= idmap_cache_map_sid(idmap_cache
, ids
[i
]);
1131 if ( ! NT_STATUS_IS_OK(ret
)) {
1134 /* alloc space for ids to be resolved by backends (realloc ten by ten) */
1135 bids
= talloc_array(ctx
, struct id_map
*, 10);
1137 DEBUG(1, ("Out of memory!\n"));
1139 return NT_STATUS_NO_MEMORY
;
1144 /* add this id to the ones to be retrieved from the backends */
1148 /* check if we need to allocate new space on the ids array */
1151 bids
= talloc_realloc(ctx
, bids
, struct id_map
*, bn
);
1153 DEBUG(1, ("Out of memory!\n"));
1155 return NT_STATUS_NO_MEMORY
;
1159 /* make sure the last element is NULL */
1164 /* let's see if there is any id mapping to be retieved from the backends */
1166 ret
= idmap_backends_sids_to_unixids(bids
);
1167 IDMAP_CHECK_RET(ret
);
1169 /* update the cache */
1170 for (i
= 0; bids
[i
]; i
++) {
1171 if (bids
[i
]->status
== ID_MAPPED
) {
1172 ret
= idmap_cache_set(idmap_cache
, bids
[i
]);
1173 } else if (bids
[i
]->status
== ID_UNKNOWN
) {
1174 /* return an expired entry in the cache or an unknown */
1175 /* this handles a previous NT_STATUS_SYNCHRONIZATION_REQUIRED
1176 * for disconnected mode */
1177 idmap_cache_map_id(idmap_cache
, ids
[i
]);
1179 ret
= idmap_cache_set_negative_sid(idmap_cache
, bids
[i
]);
1181 IDMAP_CHECK_RET(ret
);
1191 NTSTATUS
idmap_set_mapping(const struct id_map
*id
)
1196 if (! NT_STATUS_IS_OK(ret
= idmap_init())) {
1201 if ((id
->sid
== NULL
) || (id
->status
!= ID_MAPPED
)) {
1202 DEBUG(1, ("NULL SID or unmapped entry\n"));
1203 return NT_STATUS_INVALID_PARAMETER
;
1206 /* TODO: check uid/gid range ? */
1208 ctx
= talloc_named_const(NULL
, 0, "idmap_set_mapping ctx");
1210 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1211 return NT_STATUS_NO_MEMORY
;
1214 /* set the new mapping */
1215 ret
= idmap_backends_set_mapping(id
);
1216 IDMAP_CHECK_RET(ret
);
1218 /* set the mapping in the cache */
1219 ret
= idmap_cache_set(idmap_cache
, id
);
1220 IDMAP_CHECK_RET(ret
);
1227 /**************************************************************************
1228 Dump backend status.
1229 **************************************************************************/
1231 void idmap_dump_maps(char *logfile
)
1234 struct unixid allid
;
1235 struct id_map
*maps
;
1240 if (! NT_STATUS_IS_OK(ret
= idmap_init())) {
1244 dump
= fopen(logfile
, "w");
1246 DEBUG(0, ("Unable to open open stream for file [%s], errno: %d\n", logfile
, errno
));
1250 allid
.type
= ID_TYPE_UID
;
1252 alloc_methods
->get_id_hwm(&allid
);
1253 fprintf(dump
, "USER HWM %lu\n", (unsigned long)allid
.id
);
1255 allid
.type
= ID_TYPE_GID
;
1257 alloc_methods
->get_id_hwm(&allid
);
1258 fprintf(dump
, "GROUP HWM %lu\n", (unsigned long)allid
.id
);
1260 maps
= talloc(idmap_ctx
, struct id_map
);
1263 for (i
= 0; i
< num_domains
; i
++) {
1264 if (idmap_domains
[i
]->methods
->dump_data
) {
1265 idmap_domains
[i
]->methods
->dump_data(idmap_domains
[i
], &maps
, &num_maps
);
1269 for (i
= 0; i
< num_maps
; i
++) {
1270 switch (maps
[i
].xid
.type
) {
1272 fprintf(dump
, "UID %lu %s\n",
1273 (unsigned long)maps
[i
].xid
.id
,
1274 sid_string_static(maps
[i
].sid
));
1277 fprintf(dump
, "GID %lu %s\n",
1278 (unsigned long)maps
[i
].xid
.id
,
1279 sid_string_static(maps
[i
].sid
));
1288 char *idmap_fetch_secret(const char *backend
, bool alloc
,
1289 const char *domain
, const char *identity
)
1295 r
= asprintf(&tmp
, "IDMAP_ALLOC_%s", backend
);
1297 r
= asprintf(&tmp
, "IDMAP_%s_%s", backend
, domain
);
1303 strupper_m(tmp
); /* make sure the key is case insensitive */
1304 ret
= secrets_fetch_generic(tmp
, identity
);