source3/winbindd/idmap_ad.c

   1 /*
   2  *  idmap_ad: map between Active Directory and RFC 2307 or "Services for Unix" (SFU) Accounts
   3  *
   4  * Unix SMB/CIFS implementation.
   5  *
   6  * Winbind ADS backend functions
   7  *
   8  * Copyright (C) Andrew Tridgell 2001
   9  * Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
  10  * Copyright (C) Gerald (Jerry) Carter 2004-2007
  11  * Copyright (C) Luke Howard 2001-2004
  12  * Copyright (C) Michael Adam 2008,2010
  13  *
  14  * This program is free software; you can redistribute it and/or modify
  15  * it under the terms of the GNU General Public License as published by
  16  * the Free Software Foundation; either version 3 of the License, or
  17  * (at your option) any later version.
  18  *
  19  * This program is distributed in the hope that it will be useful,
  20  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  21  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22  * GNU General Public License for more details.
  23  *
  24  * You should have received a copy of the GNU General Public License
  25  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  26  */
  27
  28 #include "includes.h"
  29 #include "winbindd.h"
  30 #include "../libds/common/flags.h"
  31 #include "ads.h"
  32 #include "libads/ldap_schema.h"
  33 #include "nss_info.h"
  34 #include "idmap.h"
  35 #include "../libcli/ldap/ldap_ndr.h"
  36 #include "../libcli/security/security.h"
  37
  38 #undef DBGC_CLASS
  39 #define DBGC_CLASS DBGC_IDMAP
  40
  41 #define CHECK_ALLOC_DONE(mem) do { \
  42      if (!mem) { \
  43            DEBUG(0, ("Out of memory!\n")); \
  44            ret = NT_STATUS_NO_MEMORY; \
  45            goto done; \
  46       } \
  47 } while (0)
  48
  49 struct idmap_ad_context {
  50         ADS_STRUCT *ads;
  51         struct posix_schema *ad_schema;
  52         enum wb_posix_mapping ad_map_type; /* WB_POSIX_MAP_UNKNOWN */
  53 };
  54
  55 /************************************************************************
  56  ***********************************************************************/
  57
  58 static ADS_STATUS ad_idmap_cached_connection(struct idmap_domain *dom)
  59 {
  60         ADS_STATUS status;
  61         struct idmap_ad_context * ctx;
  62
  63         DEBUG(10, ("ad_idmap_cached_connection: called for domain '%s'\n",
  64                    dom->name));
  65
  66         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
  67
  68         status = ads_idmap_cached_connection(&ctx->ads, dom->name);
  69         if (!ADS_ERR_OK(status)) {
  70                 return status;
  71         }
  72
  73         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
  74
  75         /* if we have a valid ADS_STRUCT and the schema model is
  76            defined, then we can return here. */
  77
  78         if ( ctx->ad_schema ) {
  79                 return ADS_SUCCESS;
  80         }
  81
  82         /* Otherwise, set the schema model */
  83
  84         if ( (ctx->ad_map_type ==  WB_POSIX_MAP_SFU) ||
  85              (ctx->ad_map_type ==  WB_POSIX_MAP_SFU20) ||
  86              (ctx->ad_map_type ==  WB_POSIX_MAP_RFC2307) )
  87         {
  88                 status = ads_check_posix_schema_mapping(
  89                         ctx, ctx->ads, ctx->ad_map_type, &ctx->ad_schema);
  90                 if ( !ADS_ERR_OK(status) ) {
  91                         DEBUG(2,("ad_idmap_cached_connection: Failed to obtain schema details!\n"));
  92                 }
  93         }
  94
  95         return status;
  96 }
  97
  98 static int idmap_ad_context_destructor(struct idmap_ad_context *ctx)
  99 {
 100         if (ctx->ads != NULL) {
 101                 /* we own this ADS_STRUCT so make sure it goes away */
 102                 ctx->ads->is_mine = True;
 103                 ads_destroy( &ctx->ads );
 104                 ctx->ads = NULL;
 105         }
 106         return 0;
 107 }
 108
 109 /************************************************************************
 110  ***********************************************************************/
 111
 112 static NTSTATUS idmap_ad_initialize(struct idmap_domain *dom)
 113 {
 114         struct idmap_ad_context *ctx;
 115         char *config_option;
 116         const char *schema_mode = NULL;
 117
 118         ctx = talloc_zero(dom, struct idmap_ad_context);
 119         if (ctx == NULL) {
 120                 DEBUG(0, ("Out of memory!\n"));
 121                 return NT_STATUS_NO_MEMORY;
 122         }
 123         talloc_set_destructor(ctx, idmap_ad_context_destructor);
 124
 125         config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
 126         if (config_option == NULL) {
 127                 DEBUG(0, ("Out of memory!\n"));
 128                 talloc_free(ctx);
 129                 return NT_STATUS_NO_MEMORY;
 130         }
 131
 132         /* default map type */
 133         ctx->ad_map_type = WB_POSIX_MAP_RFC2307;
 134
 135         /* schema mode */
 136         schema_mode = lp_parm_const_string(-1, config_option, "schema_mode", NULL);
 137         if ( schema_mode && schema_mode[0] ) {
 138                 if ( strequal(schema_mode, "sfu") )
 139                         ctx->ad_map_type = WB_POSIX_MAP_SFU;
 140                 else if ( strequal(schema_mode, "sfu20" ) )
 141                         ctx->ad_map_type = WB_POSIX_MAP_SFU20;
 142                 else if ( strequal(schema_mode, "rfc2307" ) )
 143                         ctx->ad_map_type = WB_POSIX_MAP_RFC2307;
 144                 else
 145                         DEBUG(0,("idmap_ad_initialize: Unknown schema_mode (%s)\n",
 146                                  schema_mode));
 147         }
 148
 149         dom->private_data = ctx;
 150
 151         talloc_free(config_option);
 152
 153         return NT_STATUS_OK;
 154 }
 155
 156 /************************************************************************
 157  ***********************************************************************/
 158
 159 static NTSTATUS idmap_ad_unixids_to_sids(struct idmap_domain *dom, struct id_map **ids)
 160 {
 161         NTSTATUS ret;
 162         TALLOC_CTX *memctx;
 163         struct idmap_ad_context *ctx;
 164         ADS_STATUS rc;
 165         const char *attrs[] = { "sAMAccountType",
 166                                 "objectSid",
 167                                 NULL, /* uidnumber */
 168                                 NULL, /* gidnumber */
 169                                 NULL };
 170         LDAPMessage *res = NULL;
 171         LDAPMessage *entry = NULL;
 172         char *filter = NULL;
 173         int idx = 0;
 174         int bidx = 0;
 175         int count;
 176         int i;
 177         char *u_filter = NULL;
 178         char *g_filter = NULL;
 179
 180         /* initialize the status to avoid suprise */
 181         for (i = 0; ids[i]; i++) {
 182                 ids[i]->status = ID_UNKNOWN;
 183         }
 184
 185         /* Only do query if we are online */
 186         if (idmap_is_offline()) {
 187                 return NT_STATUS_FILE_IS_OFFLINE;
 188         }
 189
 190         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
 191
 192         if ( (memctx = talloc_new(ctx)) == NULL ) {
 193                 DEBUG(0, ("Out of memory!\n"));
 194                 return NT_STATUS_NO_MEMORY;
 195         }
 196
 197         rc = ad_idmap_cached_connection(dom);
 198         if (!ADS_ERR_OK(rc)) {
 199                 DEBUG(1, ("ADS uninitialized: %s\n", ads_errstr(rc)));
 200                 ret = NT_STATUS_UNSUCCESSFUL;
 201                 /* ret = ads_ntstatus(rc); */
 202                 goto done;
 203         }
 204
 205         attrs[2] = ctx->ad_schema->posix_uidnumber_attr;
 206         attrs[3] = ctx->ad_schema->posix_gidnumber_attr;
 207
 208 again:
 209         bidx = idx;
 210         for (i = 0; (i < IDMAP_LDAP_MAX_IDS) && ids[idx]; i++, idx++) {
 211                 switch (ids[idx]->xid.type) {
 212                 case ID_TYPE_UID:
 213                         if ( ! u_filter) {
 214                                 u_filter = talloc_asprintf(memctx, "(&(|"
 215                                                            "(sAMAccountType=%d)"
 216                                                            "(sAMAccountType=%d)"
 217                                                            "(sAMAccountType=%d))(|",
 218                                                            ATYPE_NORMAL_ACCOUNT,
 219                                                            ATYPE_WORKSTATION_TRUST,
 220                                                            ATYPE_INTERDOMAIN_TRUST);
 221                         }
 222                         u_filter = talloc_asprintf_append_buffer(u_filter, "(%s=%lu)",
 223                                                           ctx->ad_schema->posix_uidnumber_attr,
 224                                                           (unsigned long)ids[idx]->xid.id);
 225                         CHECK_ALLOC_DONE(u_filter);
 226                         break;
 227
 228                 case ID_TYPE_GID:
 229                         if ( ! g_filter) {
 230                                 g_filter = talloc_asprintf(memctx, "(&(|"
 231                                                            "(sAMAccountType=%d)"
 232                                                            "(sAMAccountType=%d))(|",
 233                                                            ATYPE_SECURITY_GLOBAL_GROUP,
 234                                                            ATYPE_SECURITY_LOCAL_GROUP);
 235                         }
 236                         g_filter = talloc_asprintf_append_buffer(g_filter, "(%s=%lu)",
 237                                                           ctx->ad_schema->posix_gidnumber_attr,
 238                                                           (unsigned long)ids[idx]->xid.id);
 239                         CHECK_ALLOC_DONE(g_filter);
 240                         break;
 241
 242                 default:
 243                         DEBUG(3, ("Error: mapping requested but Unknown ID type\n"));
 244                         ids[idx]->status = ID_UNKNOWN;
 245                         continue;
 246                 }
 247         }
 248         filter = talloc_asprintf(memctx, "(|");
 249         CHECK_ALLOC_DONE(filter);
 250         if ( u_filter) {
 251                 filter = talloc_asprintf_append_buffer(filter, "%s))", u_filter);
 252                 CHECK_ALLOC_DONE(filter);
 253                         TALLOC_FREE(u_filter);
 254         }
 255         if ( g_filter) {
 256                 filter = talloc_asprintf_append_buffer(filter, "%s))", g_filter);
 257                 CHECK_ALLOC_DONE(filter);
 258                 TALLOC_FREE(g_filter);
 259         }
 260         filter = talloc_asprintf_append_buffer(filter, ")");
 261         CHECK_ALLOC_DONE(filter);
 262
 263         rc = ads_search_retry(ctx->ads, &res, filter, attrs);
 264         if (!ADS_ERR_OK(rc)) {
 265                 DEBUG(1, ("ERROR: ads search returned: %s\n", ads_errstr(rc)));
 266                 ret = NT_STATUS_UNSUCCESSFUL;
 267                 goto done;
 268         }
 269
 270         if ( (count = ads_count_replies(ctx->ads, res)) == 0 ) {
 271                 DEBUG(10, ("No IDs found\n"));
 272         }
 273
 274         entry = res;
 275         for (i = 0; (i < count) && entry; i++) {
 276                 struct dom_sid sid;
 277                 enum id_type type;
 278                 struct id_map *map;
 279                 uint32_t id;
 280                 uint32_t atype;
 281
 282                 if (i == 0) { /* first entry */
 283                         entry = ads_first_entry(ctx->ads, entry);
 284                 } else { /* following ones */
 285                         entry = ads_next_entry(ctx->ads, entry);
 286                 }
 287
 288                 if ( !entry ) {
 289                         DEBUG(2, ("ERROR: Unable to fetch ldap entries from results\n"));
 290                         break;
 291                 }
 292
 293                 /* first check if the SID is present */
 294                 if (!ads_pull_sid(ctx->ads, entry, "objectSid", &sid)) {
 295                         DEBUG(2, ("Could not retrieve SID from entry\n"));
 296                         continue;
 297                 }
 298
 299                 /* get type */
 300                 if (!ads_pull_uint32(ctx->ads, entry, "sAMAccountType", &atype)) {
 301                         DEBUG(1, ("could not get SAM account type\n"));
 302                         continue;
 303                 }
 304
 305                 switch (atype & 0xF0000000) {
 306                 case ATYPE_SECURITY_GLOBAL_GROUP:
 307                 case ATYPE_SECURITY_LOCAL_GROUP:
 308                         type = ID_TYPE_GID;
 309                         break;
 310                 case ATYPE_NORMAL_ACCOUNT:
 311                 case ATYPE_WORKSTATION_TRUST:
 312                 case ATYPE_INTERDOMAIN_TRUST:
 313                         type = ID_TYPE_UID;
 314                         break;
 315                 default:
 316                         DEBUG(1, ("unrecognized SAM account type %08x\n", atype));
 317                         continue;
 318                 }
 319
 320                 if (!ads_pull_uint32(ctx->ads, entry, (type==ID_TYPE_UID) ?
 321                                                  ctx->ad_schema->posix_uidnumber_attr :
 322                                                  ctx->ad_schema->posix_gidnumber_attr,
 323                                      &id))
 324                 {
 325                         DEBUG(1, ("Could not get SID for unix ID %u\n", (unsigned) id));
 326                         continue;
 327                 }
 328
 329                 if (!idmap_unix_id_is_in_range(id, dom)) {
 330                         DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
 331                                 id, dom->low_id, dom->high_id));
 332                         continue;
 333                 }
 334
 335                 map = idmap_find_map_by_id(&ids[bidx], type, id);
 336                 if (!map) {
 337                         DEBUG(2, ("WARNING: couldn't match result with requested ID\n"));
 338                         continue;
 339                 }
 340
 341                 sid_copy(map->sid, &sid);
 342
 343                 /* mapped */
 344                 map->status = ID_MAPPED;
 345
 346                 DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
 347                            (unsigned long)map->xid.id,
 348                            map->xid.type));
 349         }
 350
 351         if (res) {
 352                 ads_msgfree(ctx->ads, res);
 353         }
 354
 355         if (ids[idx]) { /* still some values to map */
 356                 goto again;
 357         }
 358
 359         ret = NT_STATUS_OK;
 360
 361         /* mark all unknown/expired ones as unmapped */
 362         for (i = 0; ids[i]; i++) {
 363                 if (ids[i]->status != ID_MAPPED)
 364                         ids[i]->status = ID_UNMAPPED;
 365         }
 366
 367 done:
 368         talloc_free(memctx);
 369         return ret;
 370 }
 371
 372 /************************************************************************
 373  ***********************************************************************/
 374
 375 static NTSTATUS idmap_ad_sids_to_unixids(struct idmap_domain *dom, struct id_map **ids)
 376 {
 377         NTSTATUS ret;
 378         TALLOC_CTX *memctx;
 379         struct idmap_ad_context *ctx;
 380         ADS_STATUS rc;
 381         const char *attrs[] = { "sAMAccountType",
 382                                 "objectSid",
 383                                 NULL, /* attr_uidnumber */
 384                                 NULL, /* attr_gidnumber */
 385                                 NULL };
 386         LDAPMessage *res = NULL;
 387         LDAPMessage *entry = NULL;
 388         char *filter = NULL;
 389         int idx = 0;
 390         int bidx = 0;
 391         int count;
 392         int i;
 393         char *sidstr;
 394
 395         /* initialize the status to avoid suprise */
 396         for (i = 0; ids[i]; i++) {
 397                 ids[i]->status = ID_UNKNOWN;
 398         }
 399
 400         /* Only do query if we are online */
 401         if (idmap_is_offline()) {
 402                 return NT_STATUS_FILE_IS_OFFLINE;
 403         }
 404
 405         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
 406
 407         if ( (memctx = talloc_new(ctx)) == NULL ) {
 408                 DEBUG(0, ("Out of memory!\n"));
 409                 return NT_STATUS_NO_MEMORY;
 410         }
 411
 412         rc = ad_idmap_cached_connection(dom);
 413         if (!ADS_ERR_OK(rc)) {
 414                 DEBUG(1, ("ADS uninitialized: %s\n", ads_errstr(rc)));
 415                 ret = NT_STATUS_UNSUCCESSFUL;
 416                 /* ret = ads_ntstatus(rc); */
 417                 goto done;
 418         }
 419
 420         if (ctx->ad_schema == NULL) {
 421                 DEBUG(0, ("haven't got ctx->ad_schema ! \n"));
 422                 ret = NT_STATUS_UNSUCCESSFUL;
 423                 goto done;
 424         }
 425
 426         attrs[2] = ctx->ad_schema->posix_uidnumber_attr;
 427         attrs[3] = ctx->ad_schema->posix_gidnumber_attr;
 428
 429 again:
 430         filter = talloc_asprintf(memctx, "(&(|"
 431                                  "(sAMAccountType=%d)(sAMAccountType=%d)(sAMAccountType=%d)" /* user account types */
 432                                  "(sAMAccountType=%d)(sAMAccountType=%d)" /* group account types */
 433                                  ")(|",
 434                                  ATYPE_NORMAL_ACCOUNT, ATYPE_WORKSTATION_TRUST, ATYPE_INTERDOMAIN_TRUST,
 435                                  ATYPE_SECURITY_GLOBAL_GROUP, ATYPE_SECURITY_LOCAL_GROUP);
 436
 437         CHECK_ALLOC_DONE(filter);
 438
 439         bidx = idx;
 440         for (i = 0; (i < IDMAP_LDAP_MAX_IDS) && ids[idx]; i++, idx++) {
 441
 442                 ids[idx]->status = ID_UNKNOWN;
 443
 444                 sidstr = ldap_encode_ndr_dom_sid(talloc_tos(), ids[idx]->sid);
 445                 filter = talloc_asprintf_append_buffer(filter, "(objectSid=%s)", sidstr);
 446
 447                 TALLOC_FREE(sidstr);
 448                 CHECK_ALLOC_DONE(filter);
 449         }
 450         filter = talloc_asprintf_append_buffer(filter, "))");
 451         CHECK_ALLOC_DONE(filter);
 452         DEBUG(10, ("Filter: [%s]\n", filter));
 453
 454         rc = ads_search_retry(ctx->ads, &res, filter, attrs);
 455         if (!ADS_ERR_OK(rc)) {
 456                 DEBUG(1, ("ERROR: ads search returned: %s\n", ads_errstr(rc)));
 457                 ret = NT_STATUS_UNSUCCESSFUL;
 458                 goto done;
 459         }
 460
 461         if ( (count = ads_count_replies(ctx->ads, res)) == 0 ) {
 462                 DEBUG(10, ("No IDs found\n"));
 463         }
 464
 465         entry = res;
 466         for (i = 0; (i < count) && entry; i++) {
 467                 struct dom_sid sid;
 468                 enum id_type type;
 469                 struct id_map *map;
 470                 uint32_t id;
 471                 uint32_t atype;
 472
 473                 if (i == 0) { /* first entry */
 474                         entry = ads_first_entry(ctx->ads, entry);
 475                 } else { /* following ones */
 476                         entry = ads_next_entry(ctx->ads, entry);
 477                 }
 478
 479                 if ( !entry ) {
 480                         DEBUG(2, ("ERROR: Unable to fetch ldap entries from results\n"));
 481                         break;
 482                 }
 483
 484                 /* first check if the SID is present */
 485                 if (!ads_pull_sid(ctx->ads, entry, "objectSid", &sid)) {
 486                         DEBUG(2, ("Could not retrieve SID from entry\n"));
 487                         continue;
 488                 }
 489
 490                 map = idmap_find_map_by_sid(&ids[bidx], &sid);
 491                 if (!map) {
 492                         DEBUG(2, ("WARNING: couldn't match result with requested SID\n"));
 493                         continue;
 494                 }
 495
 496                 /* get type */
 497                 if (!ads_pull_uint32(ctx->ads, entry, "sAMAccountType", &atype)) {
 498                         DEBUG(1, ("could not get SAM account type\n"));
 499                         continue;
 500                 }
 501
 502                 switch (atype & 0xF0000000) {
 503                 case ATYPE_SECURITY_GLOBAL_GROUP:
 504                 case ATYPE_SECURITY_LOCAL_GROUP:
 505                         type = ID_TYPE_GID;
 506                         break;
 507                 case ATYPE_NORMAL_ACCOUNT:
 508                 case ATYPE_WORKSTATION_TRUST:
 509                 case ATYPE_INTERDOMAIN_TRUST:
 510                         type = ID_TYPE_UID;
 511                         break;
 512                 default:
 513                         DEBUG(1, ("unrecognized SAM account type %08x\n", atype));
 514                         continue;
 515                 }
 516
 517                 if (!ads_pull_uint32(ctx->ads, entry, (type==ID_TYPE_UID) ?
 518                                                  ctx->ad_schema->posix_uidnumber_attr :
 519                                                  ctx->ad_schema->posix_gidnumber_attr,
 520                                      &id))
 521                 {
 522                         DEBUG(1, ("Could not get unix ID for SID %s\n",
 523                                 sid_string_dbg(map->sid)));
 524                         continue;
 525                 }
 526                 if (!idmap_unix_id_is_in_range(id, dom)) {
 527                         DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
 528                                 id, dom->low_id, dom->high_id));
 529                         continue;
 530                 }
 531
 532                 /* mapped */
 533                 map->xid.type = type;
 534                 map->xid.id = id;
 535                 map->status = ID_MAPPED;
 536
 537                 DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
 538                            (unsigned long)map->xid.id,
 539                            map->xid.type));
 540         }
 541
 542         if (res) {
 543                 ads_msgfree(ctx->ads, res);
 544         }
 545
 546         if (ids[idx]) { /* still some values to map */
 547                 goto again;
 548         }
 549
 550         ret = NT_STATUS_OK;
 551
 552         /* mark all unknown/expired ones as unmapped */
 553         for (i = 0; ids[i]; i++) {
 554                 if (ids[i]->status != ID_MAPPED)
 555                         ids[i]->status = ID_UNMAPPED;
 556         }
 557
 558 done:
 559         talloc_free(memctx);
 560         return ret;
 561 }
 562
 563 /*
 564  * nss_info_{sfu,sfu20,rfc2307}
 565  */
 566
 567 /************************************************************************
 568  Initialize the {sfu,sfu20,rfc2307} state
 569  ***********************************************************************/
 570
 571 static const char *wb_posix_map_unknown_string = "WB_POSIX_MAP_UNKNOWN";
 572 static const char *wb_posix_map_template_string = "WB_POSIX_MAP_TEMPLATE";
 573 static const char *wb_posix_map_sfu_string = "WB_POSIX_MAP_SFU";
 574 static const char *wb_posix_map_sfu20_string = "WB_POSIX_MAP_SFU20";
 575 static const char *wb_posix_map_rfc2307_string = "WB_POSIX_MAP_RFC2307";
 576 static const char *wb_posix_map_unixinfo_string = "WB_POSIX_MAP_UNIXINFO";
 577
 578 static const char *ad_map_type_string(enum wb_posix_mapping map_type)
 579 {
 580         switch (map_type) {
 581                 case WB_POSIX_MAP_TEMPLATE:
 582                         return wb_posix_map_template_string;
 583                 case WB_POSIX_MAP_SFU:
 584                         return wb_posix_map_sfu_string;
 585                 case WB_POSIX_MAP_SFU20:
 586                         return wb_posix_map_sfu20_string;
 587                 case WB_POSIX_MAP_RFC2307:
 588                         return wb_posix_map_rfc2307_string;
 589                 case WB_POSIX_MAP_UNIXINFO:
 590                         return wb_posix_map_unixinfo_string;
 591                 default:
 592                         return wb_posix_map_unknown_string;
 593         }
 594 }
 595
 596 static NTSTATUS nss_ad_generic_init(struct nss_domain_entry *e,
 597                                     enum wb_posix_mapping new_ad_map_type)
 598 {
 599         struct idmap_domain *dom;
 600         struct idmap_ad_context *ctx;
 601
 602         if (e->state != NULL) {
 603                 dom = talloc_get_type(e->state, struct idmap_domain);
 604         } else {
 605                 dom = talloc_zero(e, struct idmap_domain);
 606                 if (dom == NULL) {
 607                         DEBUG(0, ("Out of memory!\n"));
 608                         return NT_STATUS_NO_MEMORY;
 609                 }
 610                 e->state = dom;
 611         }
 612
 613         if (e->domain != NULL) {
 614                 dom->name = talloc_strdup(dom, e->domain);
 615                 if (dom->name == NULL) {
 616                         DEBUG(0, ("Out of memory!\n"));
 617                         return NT_STATUS_NO_MEMORY;
 618                 }
 619         }
 620
 621         if (dom->private_data != NULL) {
 622                 ctx = talloc_get_type(dom->private_data,
 623                                       struct idmap_ad_context);
 624         } else {
 625                 ctx = talloc_zero(dom, struct idmap_ad_context);
 626                 if (ctx == NULL) {
 627                         DEBUG(0, ("Out of memory!\n"));
 628                         return NT_STATUS_NO_MEMORY;
 629                 }
 630                 ctx->ad_map_type = WB_POSIX_MAP_RFC2307;
 631                 dom->private_data = ctx;
 632         }
 633
 634         if ((ctx->ad_map_type != WB_POSIX_MAP_UNKNOWN) &&
 635             (ctx->ad_map_type != new_ad_map_type))
 636         {
 637                 DEBUG(2, ("nss_ad_generic_init: "
 638                           "Warning: overriding previously set posix map type "
 639                           "%s for domain %s with map type %s.\n",
 640                           ad_map_type_string(ctx->ad_map_type),
 641                           dom->name,
 642                           ad_map_type_string(new_ad_map_type)));
 643         }
 644
 645         ctx->ad_map_type = new_ad_map_type;
 646
 647         return NT_STATUS_OK;
 648 }
 649
 650 static NTSTATUS nss_sfu_init( struct nss_domain_entry *e )
 651 {
 652         return nss_ad_generic_init(e, WB_POSIX_MAP_SFU);
 653 }
 654
 655 static NTSTATUS nss_sfu20_init( struct nss_domain_entry *e )
 656 {
 657         return nss_ad_generic_init(e, WB_POSIX_MAP_SFU20);
 658 }
 659
 660 static NTSTATUS nss_rfc2307_init( struct nss_domain_entry *e )
 661 {
 662         return nss_ad_generic_init(e, WB_POSIX_MAP_RFC2307);
 663 }
 664
 665
 666 /************************************************************************
 667  ***********************************************************************/
 668
 669 static NTSTATUS nss_ad_get_info( struct nss_domain_entry *e,
 670                                   const struct dom_sid *sid,
 671                                   TALLOC_CTX *mem_ctx,
 672                                   const char **homedir,
 673                                   const char **shell,
 674                                   const char **gecos,
 675                                   uint32_t *gid )
 676 {
 677         const char *attrs[] = {NULL, /* attr_homedir */
 678                                NULL, /* attr_shell */
 679                                NULL, /* attr_gecos */
 680                                NULL, /* attr_gidnumber */
 681                                NULL };
 682         char *filter = NULL;
 683         LDAPMessage *msg_internal = NULL;
 684         ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
 685         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
 686         char *sidstr = NULL;
 687         struct idmap_domain *dom;
 688         struct idmap_ad_context *ctx;
 689
 690         DEBUG(10, ("nss_ad_get_info called for sid [%s] in domain '%s'\n",
 691                    sid_string_dbg(sid), e->domain?e->domain:"NULL"));
 692
 693         /* Only do query if we are online */
 694         if (idmap_is_offline()) {
 695                 return NT_STATUS_FILE_IS_OFFLINE;
 696         }
 697
 698         dom = talloc_get_type(e->state, struct idmap_domain);
 699         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
 700
 701         ads_status = ad_idmap_cached_connection(dom);
 702         if (!ADS_ERR_OK(ads_status)) {
 703                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 704         }
 705
 706         if (!ctx->ad_schema) {
 707                 DEBUG(10, ("nss_ad_get_info: no ad_schema configured!\n"));
 708                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 709         }
 710
 711         if (!sid || !homedir || !shell || !gecos) {
 712                 return NT_STATUS_INVALID_PARAMETER;
 713         }
 714
 715         /* Have to do our own query */
 716
 717         DEBUG(10, ("nss_ad_get_info: no ads connection given, doing our "
 718                    "own query\n"));
 719
 720         attrs[0] = ctx->ad_schema->posix_homedir_attr;
 721         attrs[1] = ctx->ad_schema->posix_shell_attr;
 722         attrs[2] = ctx->ad_schema->posix_gecos_attr;
 723         attrs[3] = ctx->ad_schema->posix_gidnumber_attr;
 724
 725         sidstr = ldap_encode_ndr_dom_sid(mem_ctx, sid);
 726         filter = talloc_asprintf(mem_ctx, "(objectSid=%s)", sidstr);
 727         TALLOC_FREE(sidstr);
 728
 729         if (!filter) {
 730                 nt_status = NT_STATUS_NO_MEMORY;
 731                 goto done;
 732         }
 733
 734         ads_status = ads_search_retry(ctx->ads, &msg_internal, filter, attrs);
 735         if (!ADS_ERR_OK(ads_status)) {
 736                 nt_status = ads_ntstatus(ads_status);
 737                 goto done;
 738         }
 739
 740         *homedir = ads_pull_string(ctx->ads, mem_ctx, msg_internal, ctx->ad_schema->posix_homedir_attr);
 741         *shell   = ads_pull_string(ctx->ads, mem_ctx, msg_internal, ctx->ad_schema->posix_shell_attr);
 742         *gecos   = ads_pull_string(ctx->ads, mem_ctx, msg_internal, ctx->ad_schema->posix_gecos_attr);
 743
 744         if (gid) {
 745                 if (!ads_pull_uint32(ctx->ads, msg_internal, ctx->ad_schema->posix_gidnumber_attr, gid))
 746                         *gid = (uint32_t)-1;
 747         }
 748
 749         nt_status = NT_STATUS_OK;
 750
 751 done:
 752         if (msg_internal) {
 753                 ads_msgfree(ctx->ads, msg_internal);
 754         }
 755
 756         return nt_status;
 757 }
 758
 759 /**********************************************************************
 760  *********************************************************************/
 761
 762 static NTSTATUS nss_ad_map_to_alias(TALLOC_CTX *mem_ctx,
 763                                     struct nss_domain_entry *e,
 764                                     const char *name,
 765                                     char **alias)
 766 {
 767         const char *attrs[] = {NULL, /* attr_uid */
 768                                NULL };
 769         char *filter = NULL;
 770         LDAPMessage *msg = NULL;
 771         ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
 772         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
 773         struct idmap_domain *dom;
 774         struct idmap_ad_context *ctx = NULL;
 775
 776         /* Check incoming parameters */
 777
 778         if ( !e || !e->domain || !name || !*alias) {
 779                 nt_status = NT_STATUS_INVALID_PARAMETER;
 780                 goto done;
 781         }
 782
 783         /* Only do query if we are online */
 784
 785         if (idmap_is_offline()) {
 786                 nt_status = NT_STATUS_FILE_IS_OFFLINE;
 787                 goto done;
 788         }
 789
 790         dom = talloc_get_type(e->state, struct idmap_domain);
 791         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
 792
 793         ads_status = ad_idmap_cached_connection(dom);
 794         if (!ADS_ERR_OK(ads_status)) {
 795                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 796         }
 797
 798         if (!ctx->ad_schema) {
 799                 nt_status = NT_STATUS_OBJECT_PATH_NOT_FOUND;
 800                 goto done;
 801         }
 802
 803         attrs[0] = ctx->ad_schema->posix_uid_attr;
 804
 805         filter = talloc_asprintf(mem_ctx,
 806                                  "(sAMAccountName=%s)",
 807                                  name);
 808         if (!filter) {
 809                 nt_status = NT_STATUS_NO_MEMORY;
 810                 goto done;
 811         }
 812
 813         ads_status = ads_search_retry(ctx->ads, &msg, filter, attrs);
 814         if (!ADS_ERR_OK(ads_status)) {
 815                 nt_status = ads_ntstatus(ads_status);
 816                 goto done;
 817         }
 818
 819         *alias = ads_pull_string(ctx->ads, mem_ctx, msg, ctx->ad_schema->posix_uid_attr);
 820
 821         if (!*alias) {
 822                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 823         }
 824
 825         nt_status = NT_STATUS_OK;
 826
 827 done:
 828         if (filter) {
 829                 talloc_destroy(filter);
 830         }
 831         if (msg) {
 832                 ads_msgfree(ctx->ads, msg);
 833         }
 834
 835         return nt_status;
 836 }
 837
 838 /**********************************************************************
 839  *********************************************************************/
 840
 841 static NTSTATUS nss_ad_map_from_alias( TALLOC_CTX *mem_ctx,
 842                                              struct nss_domain_entry *e,
 843                                              const char *alias,
 844                                              char **name )
 845 {
 846         const char *attrs[] = {"sAMAccountName",
 847                                NULL };
 848         char *filter = NULL;
 849         LDAPMessage *msg = NULL;
 850         ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
 851         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
 852         char *username;
 853         struct idmap_domain *dom;
 854         struct idmap_ad_context *ctx = NULL;
 855
 856         /* Check incoming parameters */
 857
 858         if ( !alias || !name) {
 859                 nt_status = NT_STATUS_INVALID_PARAMETER;
 860                 goto done;
 861         }
 862
 863         /* Only do query if we are online */
 864
 865         if (idmap_is_offline()) {
 866                 nt_status = NT_STATUS_FILE_IS_OFFLINE;
 867                 goto done;
 868         }
 869
 870         dom = talloc_get_type(e->state, struct idmap_domain);
 871         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
 872
 873         ads_status = ad_idmap_cached_connection(dom);
 874         if (!ADS_ERR_OK(ads_status)) {
 875                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 876         }
 877
 878         if (!ctx->ad_schema) {
 879                 nt_status = NT_STATUS_OBJECT_PATH_NOT_FOUND;
 880                 goto done;
 881         }
 882
 883         filter = talloc_asprintf(mem_ctx,
 884                                  "(%s=%s)",
 885                                  ctx->ad_schema->posix_uid_attr,
 886                                  alias);
 887         if (!filter) {
 888                 nt_status = NT_STATUS_NO_MEMORY;
 889                 goto done;
 890         }
 891
 892         ads_status = ads_search_retry(ctx->ads, &msg, filter, attrs);
 893         if (!ADS_ERR_OK(ads_status)) {
 894                 nt_status = ads_ntstatus(ads_status);
 895                 goto done;
 896         }
 897
 898         username = ads_pull_string(ctx->ads, mem_ctx, msg,
 899                                    "sAMAccountName");
 900         if (!username) {
 901                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 902         }
 903
 904         *name = talloc_asprintf(mem_ctx, "%s\\%s",
 905                                 lp_workgroup(),
 906                                 username);
 907         if (!*name) {
 908                 nt_status = NT_STATUS_NO_MEMORY;
 909                 goto done;
 910         }
 911
 912         nt_status = NT_STATUS_OK;
 913
 914 done:
 915         if (filter) {
 916                 talloc_destroy(filter);
 917         }
 918         if (msg) {
 919                 ads_msgfree(ctx->ads, msg);
 920         }
 921
 922         return nt_status;
 923 }
 924
 925 /************************************************************************
 926  Function dispatch tables for the idmap and nss plugins
 927  ***********************************************************************/
 928
 929 static struct idmap_methods ad_methods = {
 930         .init            = idmap_ad_initialize,
 931         .unixids_to_sids = idmap_ad_unixids_to_sids,
 932         .sids_to_unixids = idmap_ad_sids_to_unixids,
 933 };
 934
 935 /* The SFU and RFC2307 NSS plugins share everything but the init
 936    function which sets the intended schema model to use */
 937
 938 static struct nss_info_methods nss_rfc2307_methods = {
 939         .init           = nss_rfc2307_init,
 940         .get_nss_info   = nss_ad_get_info,
 941         .map_to_alias   = nss_ad_map_to_alias,
 942         .map_from_alias = nss_ad_map_from_alias,
 943 };
 944
 945 static struct nss_info_methods nss_sfu_methods = {
 946         .init           = nss_sfu_init,
 947         .get_nss_info   = nss_ad_get_info,
 948         .map_to_alias   = nss_ad_map_to_alias,
 949         .map_from_alias = nss_ad_map_from_alias,
 950 };
 951
 952 static struct nss_info_methods nss_sfu20_methods = {
 953         .init           = nss_sfu20_init,
 954         .get_nss_info   = nss_ad_get_info,
 955         .map_to_alias   = nss_ad_map_to_alias,
 956         .map_from_alias = nss_ad_map_from_alias,
 957 };
 958
 959
 960
 961 /************************************************************************
 962  Initialize the plugins
 963  ***********************************************************************/
 964
 965 NTSTATUS idmap_ad_init(void)
 966 {
 967         static NTSTATUS status_idmap_ad = NT_STATUS_UNSUCCESSFUL;
 968         static NTSTATUS status_nss_rfc2307 = NT_STATUS_UNSUCCESSFUL;
 969         static NTSTATUS status_nss_sfu = NT_STATUS_UNSUCCESSFUL;
 970         static NTSTATUS status_nss_sfu20 = NT_STATUS_UNSUCCESSFUL;
 971
 972         /* Always register the AD method first in order to get the
 973            idmap_domain interface called */
 974
 975         if ( !NT_STATUS_IS_OK(status_idmap_ad) ) {
 976                 status_idmap_ad = smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION,
 977                                                      "ad", &ad_methods);
 978                 if ( !NT_STATUS_IS_OK(status_idmap_ad) )
 979                         return status_idmap_ad;
 980         }
 981
 982         if ( !NT_STATUS_IS_OK( status_nss_rfc2307 ) ) {
 983                 status_nss_rfc2307 = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
 984                                                             "rfc2307",  &nss_rfc2307_methods );
 985                 if ( !NT_STATUS_IS_OK(status_nss_rfc2307) )
 986                         return status_nss_rfc2307;
 987         }
 988
 989         if ( !NT_STATUS_IS_OK( status_nss_sfu ) ) {
 990                 status_nss_sfu = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
 991                                                         "sfu",  &nss_sfu_methods );
 992                 if ( !NT_STATUS_IS_OK(status_nss_sfu) )
 993                         return status_nss_sfu;
 994         }
 995
 996         if ( !NT_STATUS_IS_OK( status_nss_sfu20 ) ) {
 997                 status_nss_sfu20 = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
 998                                                         "sfu20",  &nss_sfu20_methods );
 999                 if ( !NT_STATUS_IS_OK(status_nss_sfu20) )
1000                         return status_nss_sfu20;
1001         }
1002
1003         return NT_STATUS_OK;
1004 }
1005