2 Unix SMB/CIFS implementation.
4 Winbind daemon for ntdom nss module
6 Copyright (C) Tim Potter 2000-2001
7 Copyright (C) 2001 by Martin Pool <mbp@samba.org>
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
28 #define DBGC_CLASS DBGC_WINBIND
30 extern struct winbindd_methods cache_methods
;
31 extern struct winbindd_methods passdb_methods
;
34 * @file winbindd_util.c
36 * Winbind daemon for NT domain authentication nss module.
39 /* The list of trusted domains. Note that the list can be deleted and
40 recreated using the init_domain_list() function so pointers to
41 individual winbindd_domain structures cannot be made. Keep a copy of
42 the domain name instead. */
44 static struct winbindd_domain
*_domain_list
;
47 When was the last scan of trusted domains done?
52 static time_t last_trustdom_scan
;
54 struct winbindd_domain
*domain_list(void)
58 if ((!_domain_list
) && (!init_domain_list())) {
59 smb_panic("Init_domain_list failed\n");
65 /* Free all entries in the trusted domain list */
67 void free_domain_list(void)
69 struct winbindd_domain
*domain
= _domain_list
;
72 struct winbindd_domain
*next
= domain
->next
;
74 DLIST_REMOVE(_domain_list
, domain
);
80 static BOOL
is_internal_domain(const DOM_SID
*sid
)
85 return (sid_check_is_domain(sid
) || sid_check_is_builtin(sid
));
88 static BOOL
is_in_internal_domain(const DOM_SID
*sid
)
93 return (sid_check_is_in_our_domain(sid
) || sid_check_is_in_builtin(sid
));
97 /* Add a trusted domain to our list of domains */
98 static struct winbindd_domain
*add_trusted_domain(const char *domain_name
, const char *alt_name
,
99 struct winbindd_methods
*methods
,
102 struct winbindd_domain
*domain
;
103 const char *alternative_name
= NULL
;
105 /* ignore alt_name if we are not in an AD domain */
107 if ( (lp_security() == SEC_ADS
) && alt_name
&& *alt_name
) {
108 alternative_name
= alt_name
;
111 /* We can't call domain_list() as this function is called from
112 init_domain_list() and we'll get stuck in a loop. */
113 for (domain
= _domain_list
; domain
; domain
= domain
->next
) {
114 if (strequal(domain_name
, domain
->name
) ||
115 strequal(domain_name
, domain
->alt_name
))
120 if (alternative_name
&& *alternative_name
)
122 if (strequal(alternative_name
, domain
->name
) ||
123 strequal(alternative_name
, domain
->alt_name
))
131 if (is_null_sid(sid
)) {
135 if (sid_equal(sid
, &domain
->sid
)) {
141 /* See if we found a match. Check if we need to update the
145 if ( sid_equal( &domain
->sid
, &global_sid_NULL
) )
146 sid_copy( &domain
->sid
, sid
);
151 /* Create new domain entry */
153 if ((domain
= SMB_MALLOC_P(struct winbindd_domain
)) == NULL
)
158 ZERO_STRUCTP(domain
);
160 /* prioritise the short name */
161 if (strchr_m(domain_name
, '.') && alternative_name
&& *alternative_name
) {
162 fstrcpy(domain
->name
, alternative_name
);
163 fstrcpy(domain
->alt_name
, domain_name
);
165 fstrcpy(domain
->name
, domain_name
);
166 if (alternative_name
) {
167 fstrcpy(domain
->alt_name
, alternative_name
);
171 domain
->methods
= methods
;
172 domain
->backend
= NULL
;
173 domain
->internal
= is_internal_domain(sid
);
174 domain
->sequence_number
= DOM_SEQUENCE_NONE
;
175 domain
->last_seq_check
= 0;
176 domain
->initialized
= False
;
177 domain
->online
= is_internal_domain(sid
);
178 domain
->check_online_timeout
= 0;
180 sid_copy(&domain
->sid
, sid
);
183 /* Link to domain list */
184 DLIST_ADD(_domain_list
, domain
);
186 wcache_tdc_add_domain( domain
);
188 DEBUG(2,("Added domain %s %s %s\n",
189 domain
->name
, domain
->alt_name
,
190 &domain
->sid
?sid_string_static(&domain
->sid
):""));
195 /********************************************************************
196 rescan our domains looking for new trusted domains
197 ********************************************************************/
199 struct trustdom_state
{
203 struct winbindd_response
*response
;
206 static void trustdom_recv(void *private_data
, BOOL success
);
207 static void rescan_forest_root_trusts( void );
208 static void rescan_forest_trusts( void );
210 static void add_trusted_domains( struct winbindd_domain
*domain
)
213 struct winbindd_request
*request
;
214 struct winbindd_response
*response
;
215 uint32 fr_flags
= (DS_DOMAIN_TREE_ROOT
|DS_DOMAIN_IN_FOREST
);
217 struct trustdom_state
*state
;
219 mem_ctx
= talloc_init("add_trusted_domains");
220 if (mem_ctx
== NULL
) {
221 DEBUG(0, ("talloc_init failed\n"));
225 request
= TALLOC_ZERO_P(mem_ctx
, struct winbindd_request
);
226 response
= TALLOC_P(mem_ctx
, struct winbindd_response
);
227 state
= TALLOC_P(mem_ctx
, struct trustdom_state
);
229 if ((request
== NULL
) || (response
== NULL
) || (state
== NULL
)) {
230 DEBUG(0, ("talloc failed\n"));
231 talloc_destroy(mem_ctx
);
235 state
->mem_ctx
= mem_ctx
;
236 state
->response
= response
;
238 /* Flags used to know how to continue the forest trust search */
240 state
->primary
= domain
->primary
;
241 state
->forest_root
= ((domain
->domain_flags
& fr_flags
) == fr_flags
);
243 request
->length
= sizeof(*request
);
244 request
->cmd
= WINBINDD_LIST_TRUSTDOM
;
246 async_domain_request(mem_ctx
, domain
, request
, response
,
247 trustdom_recv
, state
);
250 static void trustdom_recv(void *private_data
, BOOL success
)
252 struct trustdom_state
*state
=
253 talloc_get_type_abort(private_data
, struct trustdom_state
);
254 struct winbindd_response
*response
= state
->response
;
257 if ((!success
) || (response
->result
!= WINBINDD_OK
)) {
258 DEBUG(1, ("Could not receive trustdoms\n"));
259 talloc_destroy(state
->mem_ctx
);
263 p
= (char *)response
->extra_data
.data
;
265 while ((p
!= NULL
) && (*p
!= '\0')) {
266 char *q
, *sidstr
, *alt_name
;
268 struct winbindd_domain
*domain
;
269 char *alternate_name
= NULL
;
271 alt_name
= strchr(p
, '\\');
272 if (alt_name
== NULL
) {
273 DEBUG(0, ("Got invalid trustdom response\n"));
280 sidstr
= strchr(alt_name
, '\\');
281 if (sidstr
== NULL
) {
282 DEBUG(0, ("Got invalid trustdom response\n"));
289 q
= strchr(sidstr
, '\n');
293 if (!string_to_sid(&sid
, sidstr
)) {
294 /* Allow NULL sid for sibling domains */
295 if ( strcmp(sidstr
,"S-0-0") == 0) {
296 sid_copy( &sid
, &global_sid_NULL
);
298 DEBUG(0, ("Got invalid trustdom response\n"));
303 /* use the real alt_name if we have one, else pass in NULL */
305 if ( !strequal( alt_name
, "(null)" ) )
306 alternate_name
= alt_name
;
308 /* If we have an existing domain structure, calling
309 add_trusted_domain() will update the SID if
310 necessary. This is important because we need the
311 SID for sibling domains */
313 if ( find_domain_from_name_noinit(p
) != NULL
) {
314 domain
= add_trusted_domain(p
, alternate_name
,
318 domain
= add_trusted_domain(p
, alternate_name
,
321 setup_domain_child(domain
, &domain
->child
, NULL
);
328 SAFE_FREE(response
->extra_data
.data
);
331 Cases to consider when scanning trusts:
332 (a) we are calling from a child domain (primary && !forest_root)
333 (b) we are calling from the root of the forest (primary && forest_root)
334 (c) we are calling from a trusted forest domain (!primary
338 if ( state
->primary
) {
339 /* If this is our primary domain and we are not the in the
340 forest root, we have to scan the root trusts first */
342 if ( !state
->forest_root
)
343 rescan_forest_root_trusts();
345 rescan_forest_trusts();
347 } else if ( state
->forest_root
) {
348 /* Once we have done root forest trust search, we can
349 go on to search thing trusted forests */
351 rescan_forest_trusts();
354 talloc_destroy(state
->mem_ctx
);
359 /********************************************************************
360 Scan the trusts of our forest root
361 ********************************************************************/
363 static void rescan_forest_root_trusts( void )
365 struct winbindd_tdc_domain
*dom_list
= NULL
;
366 size_t num_trusts
= 0;
369 /* The only transitive trusts supported by Windows 2003 AD are
370 (a) Parent-Child, (b) Tree-Root, and (c) Forest. The
371 first two are handled in forest and listed by
372 DsEnumerateDomainTrusts(). Forest trusts are not so we
373 have to do that ourselves. */
375 if ( !wcache_tdc_fetch_list( &dom_list
, &num_trusts
) )
378 for ( i
=0; i
<num_trusts
; i
++ ) {
379 struct winbindd_domain
*d
= NULL
;
381 /* Find the forest root. Don't necessarily trust
382 the domain_list() as our primary domain may not
383 have been initialized. */
385 if ( !(dom_list
[i
].trust_flags
& DS_DOMAIN_TREE_ROOT
) ) {
389 /* Here's the forest root */
391 d
= find_domain_from_name_noinit( dom_list
[i
].domain_name
);
394 d
= add_trusted_domain( dom_list
[i
].domain_name
,
395 dom_list
[i
].dns_name
,
400 DEBUG(10,("rescan_forest_root_trusts: Following trust path "
401 "for domain tree root %s (%s)\n",
402 d
->name
, d
->alt_name
));
404 d
->domain_flags
= dom_list
[i
].trust_flags
;
405 d
->domain_type
= dom_list
[i
].trust_type
;
406 d
->domain_trust_attribs
= dom_list
[i
].trust_attribs
;
408 add_trusted_domains( d
);
413 TALLOC_FREE( dom_list
);
418 /********************************************************************
419 scan the transitive forest trists (not our own)
420 ********************************************************************/
423 static void rescan_forest_trusts( void )
425 struct winbindd_domain
*d
= NULL
;
426 struct winbindd_tdc_domain
*dom_list
= NULL
;
427 size_t num_trusts
= 0;
430 /* The only transitive trusts supported by Windows 2003 AD are
431 (a) Parent-Child, (b) Tree-Root, and (c) Forest. The
432 first two are handled in forest and listed by
433 DsEnumerateDomainTrusts(). Forest trusts are not so we
434 have to do that ourselves. */
436 if ( !wcache_tdc_fetch_list( &dom_list
, &num_trusts
) )
439 for ( i
=0; i
<num_trusts
; i
++ ) {
440 uint32 flags
= dom_list
[i
].trust_flags
;
441 uint32 type
= dom_list
[i
].trust_type
;
442 uint32 attribs
= dom_list
[i
].trust_attribs
;
444 d
= find_domain_from_name_noinit( dom_list
[i
].domain_name
);
446 /* ignore our primary and internal domains */
448 if ( d
&& (d
->internal
|| d
->primary
) )
451 if ( (flags
& DS_DOMAIN_DIRECT_INBOUND
) &&
452 (type
== DS_DOMAIN_TRUST_TYPE_UPLEVEL
) &&
453 (attribs
== DS_DOMAIN_TRUST_ATTRIB_FOREST_TRANSITIVE
) )
455 /* add the trusted domain if we don't know
459 d
= add_trusted_domain( dom_list
[i
].domain_name
,
460 dom_list
[i
].dns_name
,
465 DEBUG(10,("Following trust path for domain %s (%s)\n",
466 d
->name
, d
->alt_name
));
467 add_trusted_domains( d
);
471 TALLOC_FREE( dom_list
);
476 /*********************************************************************
477 The process of updating the trusted domain list is a three step
480 (b) ask the root domain in our forest
481 (c) ask the a DC in any Win2003 trusted forests
482 *********************************************************************/
484 void rescan_trusted_domains( void )
486 time_t now
= time(NULL
);
488 /* see if the time has come... */
490 if ((now
>= last_trustdom_scan
) &&
491 ((now
-last_trustdom_scan
) < WINBINDD_RESCAN_FREQ
) )
494 /* clear the TRUSTDOM cache first */
498 /* this will only add new domains we didn't already know about
499 in the domain_list()*/
501 add_trusted_domains( find_our_domain() );
503 last_trustdom_scan
= now
;
508 struct init_child_state
{
510 struct winbindd_domain
*domain
;
511 struct winbindd_request
*request
;
512 struct winbindd_response
*response
;
513 void (*continuation
)(void *private_data
, BOOL success
);
517 static void init_child_recv(void *private_data
, BOOL success
);
518 static void init_child_getdc_recv(void *private_data
, BOOL success
);
520 enum winbindd_result
init_child_connection(struct winbindd_domain
*domain
,
521 void (*continuation
)(void *private_data
,
526 struct winbindd_request
*request
;
527 struct winbindd_response
*response
;
528 struct init_child_state
*state
;
529 struct winbindd_domain
*request_domain
;
531 mem_ctx
= talloc_init("init_child_connection");
532 if (mem_ctx
== NULL
) {
533 DEBUG(0, ("talloc_init failed\n"));
534 return WINBINDD_ERROR
;
537 request
= TALLOC_ZERO_P(mem_ctx
, struct winbindd_request
);
538 response
= TALLOC_P(mem_ctx
, struct winbindd_response
);
539 state
= TALLOC_P(mem_ctx
, struct init_child_state
);
541 if ((request
== NULL
) || (response
== NULL
) || (state
== NULL
)) {
542 DEBUG(0, ("talloc failed\n"));
543 TALLOC_FREE(mem_ctx
);
544 continuation(private_data
, False
);
545 return WINBINDD_ERROR
;
548 request
->length
= sizeof(*request
);
550 state
->mem_ctx
= mem_ctx
;
551 state
->domain
= domain
;
552 state
->request
= request
;
553 state
->response
= response
;
554 state
->continuation
= continuation
;
555 state
->private_data
= private_data
;
557 if (IS_DC
|| domain
->primary
) {
558 /* The primary domain has to find the DC name itself */
559 request
->cmd
= WINBINDD_INIT_CONNECTION
;
560 fstrcpy(request
->domain_name
, domain
->name
);
561 request
->data
.init_conn
.is_primary
= True
;
562 fstrcpy(request
->data
.init_conn
.dcname
, "");
563 async_request(mem_ctx
, &domain
->child
, request
, response
,
564 init_child_recv
, state
);
565 return WINBINDD_PENDING
;
568 /* This is *not* the primary domain, let's ask our DC about a DC
571 request
->cmd
= WINBINDD_GETDCNAME
;
572 fstrcpy(request
->domain_name
, domain
->name
);
574 request_domain
= find_our_domain();
576 async_domain_request(mem_ctx
, request_domain
, request
, response
,
577 init_child_getdc_recv
, state
);
578 return WINBINDD_PENDING
;
581 static void init_child_getdc_recv(void *private_data
, BOOL success
)
583 struct init_child_state
*state
=
584 talloc_get_type_abort(private_data
, struct init_child_state
);
585 const char *dcname
= "";
587 DEBUG(10, ("Received getdcname response\n"));
589 if (success
&& (state
->response
->result
== WINBINDD_OK
)) {
590 dcname
= state
->response
->data
.dc_name
;
593 state
->request
->cmd
= WINBINDD_INIT_CONNECTION
;
594 fstrcpy(state
->request
->domain_name
, state
->domain
->name
);
595 state
->request
->data
.init_conn
.is_primary
= False
;
596 fstrcpy(state
->request
->data
.init_conn
.dcname
, dcname
);
598 async_request(state
->mem_ctx
, &state
->domain
->child
,
599 state
->request
, state
->response
,
600 init_child_recv
, state
);
603 static void init_child_recv(void *private_data
, BOOL success
)
605 struct init_child_state
*state
=
606 talloc_get_type_abort(private_data
, struct init_child_state
);
608 DEBUG(5, ("Received child initialization response for domain %s\n",
609 state
->domain
->name
));
611 if ((!success
) || (state
->response
->result
!= WINBINDD_OK
)) {
612 DEBUG(3, ("Could not init child\n"));
613 state
->continuation(state
->private_data
, False
);
614 talloc_destroy(state
->mem_ctx
);
618 fstrcpy(state
->domain
->name
,
619 state
->response
->data
.domain_info
.name
);
620 fstrcpy(state
->domain
->alt_name
,
621 state
->response
->data
.domain_info
.alt_name
);
622 string_to_sid(&state
->domain
->sid
,
623 state
->response
->data
.domain_info
.sid
);
624 state
->domain
->native_mode
=
625 state
->response
->data
.domain_info
.native_mode
;
626 state
->domain
->active_directory
=
627 state
->response
->data
.domain_info
.active_directory
;
628 state
->domain
->sequence_number
=
629 state
->response
->data
.domain_info
.sequence_number
;
631 init_dc_connection(state
->domain
);
633 if (state
->continuation
!= NULL
)
634 state
->continuation(state
->private_data
, True
);
635 talloc_destroy(state
->mem_ctx
);
638 enum winbindd_result
winbindd_dual_init_connection(struct winbindd_domain
*domain
,
639 struct winbindd_cli_state
*state
)
641 /* Ensure null termination */
642 state
->request
.domain_name
643 [sizeof(state
->request
.domain_name
)-1]='\0';
644 state
->request
.data
.init_conn
.dcname
645 [sizeof(state
->request
.data
.init_conn
.dcname
)-1]='\0';
647 if (strlen(state
->request
.data
.init_conn
.dcname
) > 0) {
648 fstrcpy(domain
->dcname
, state
->request
.data
.init_conn
.dcname
);
651 init_dc_connection(domain
);
653 if (!domain
->initialized
) {
654 /* If we return error here we can't do any cached authentication,
655 but we may be in disconnected mode and can't initialize correctly.
656 Do what the previous code did and just return without initialization,
657 once we go online we'll re-initialize.
659 DEBUG(5, ("winbindd_dual_init_connection: %s returning without initialization "
660 "online = %d\n", domain
->name
, (int)domain
->online
));
663 fstrcpy(state
->response
.data
.domain_info
.name
, domain
->name
);
664 fstrcpy(state
->response
.data
.domain_info
.alt_name
, domain
->alt_name
);
665 fstrcpy(state
->response
.data
.domain_info
.sid
,
666 sid_string_static(&domain
->sid
));
668 state
->response
.data
.domain_info
.native_mode
669 = domain
->native_mode
;
670 state
->response
.data
.domain_info
.active_directory
671 = domain
->active_directory
;
672 state
->response
.data
.domain_info
.primary
674 state
->response
.data
.domain_info
.sequence_number
=
675 domain
->sequence_number
;
680 /* Look up global info for the winbind daemon */
681 BOOL
init_domain_list(void)
683 struct winbindd_domain
*domain
;
684 int role
= lp_server_role();
686 /* Free existing list */
689 /* Add ourselves as the first entry. */
691 if ( role
== ROLE_DOMAIN_MEMBER
) {
694 if (!secrets_fetch_domain_sid(lp_workgroup(), &our_sid
)) {
695 DEBUG(0, ("Could not fetch our SID - did we join?\n"));
699 domain
= add_trusted_domain( lp_workgroup(), lp_realm(),
700 &cache_methods
, &our_sid
);
701 domain
->primary
= True
;
702 setup_domain_child(domain
, &domain
->child
, NULL
);
704 /* Even in the parent winbindd we'll need to
705 talk to the DC, so try and see if we can
706 contact it. Theoretically this isn't neccessary
707 as the init_dc_connection() in init_child_recv()
708 will do this, but we can start detecting the DC
710 set_domain_online_request(domain
);
715 domain
= add_trusted_domain(get_global_sam_name(), NULL
,
716 &passdb_methods
, get_global_sam_sid());
717 if ( role
!= ROLE_DOMAIN_MEMBER
) {
718 domain
->primary
= True
;
720 setup_domain_child(domain
, &domain
->child
, NULL
);
724 domain
= add_trusted_domain("BUILTIN", NULL
, &passdb_methods
,
725 &global_sid_Builtin
);
726 setup_domain_child(domain
, &domain
->child
, NULL
);
732 * Given a domain name, return the struct winbindd domain info for it
734 * @note Do *not* pass lp_workgroup() to this function. domain_list
735 * may modify it's value, and free that pointer. Instead, our local
736 * domain may be found by calling find_our_domain().
740 * @return The domain structure for the named domain, if it is working.
743 struct winbindd_domain
*find_domain_from_name_noinit(const char *domain_name
)
745 struct winbindd_domain
*domain
;
747 /* Search through list */
749 for (domain
= domain_list(); domain
!= NULL
; domain
= domain
->next
) {
750 if (strequal(domain_name
, domain
->name
) ||
751 (domain
->alt_name
[0] &&
752 strequal(domain_name
, domain
->alt_name
))) {
762 struct winbindd_domain
*find_domain_from_name(const char *domain_name
)
764 struct winbindd_domain
*domain
;
766 domain
= find_domain_from_name_noinit(domain_name
);
771 if (!domain
->initialized
)
772 init_dc_connection(domain
);
777 /* Given a domain sid, return the struct winbindd domain info for it */
779 struct winbindd_domain
*find_domain_from_sid_noinit(const DOM_SID
*sid
)
781 struct winbindd_domain
*domain
;
783 /* Search through list */
785 for (domain
= domain_list(); domain
!= NULL
; domain
= domain
->next
) {
786 if (sid_compare_domain(sid
, &domain
->sid
) == 0)
795 /* Given a domain sid, return the struct winbindd domain info for it */
797 struct winbindd_domain
*find_domain_from_sid(const DOM_SID
*sid
)
799 struct winbindd_domain
*domain
;
801 domain
= find_domain_from_sid_noinit(sid
);
806 if (!domain
->initialized
)
807 init_dc_connection(domain
);
812 struct winbindd_domain
*find_our_domain(void)
814 struct winbindd_domain
*domain
;
816 /* Search through list */
818 for (domain
= domain_list(); domain
!= NULL
; domain
= domain
->next
) {
823 smb_panic("Could not find our domain\n");
827 struct winbindd_domain
*find_root_domain(void)
829 struct winbindd_domain
*ours
= find_our_domain();
834 if ( strlen(ours
->forest_name
) == 0 )
837 return find_domain_from_name( ours
->forest_name
);
840 struct winbindd_domain
*find_builtin_domain(void)
843 struct winbindd_domain
*domain
;
845 string_to_sid(&sid
, "S-1-5-32");
846 domain
= find_domain_from_sid(&sid
);
849 smb_panic("Could not find BUILTIN domain\n");
854 /* Find the appropriate domain to lookup a name or SID */
856 struct winbindd_domain
*find_lookup_domain_from_sid(const DOM_SID
*sid
)
858 /* A DC can't ask the local smbd for remote SIDs, here winbindd is the
859 * one to contact the external DC's. On member servers the internal
860 * domains are different: These are part of the local SAM. */
862 DEBUG(10, ("find_lookup_domain_from_sid(%s)\n",
863 sid_string_static(sid
)));
865 if (IS_DC
|| is_internal_domain(sid
) || is_in_internal_domain(sid
)) {
866 DEBUG(10, ("calling find_domain_from_sid\n"));
867 return find_domain_from_sid(sid
);
870 /* On a member server a query for SID or name can always go to our
873 DEBUG(10, ("calling find_our_domain\n"));
874 return find_our_domain();
877 struct winbindd_domain
*find_lookup_domain_from_name(const char *domain_name
)
879 if (IS_DC
|| strequal(domain_name
, "BUILTIN") ||
880 strequal(domain_name
, get_global_sam_name()))
881 return find_domain_from_name_noinit(domain_name
);
883 return find_our_domain();
886 /* Lookup a sid in a domain from a name */
888 BOOL
winbindd_lookup_sid_by_name(TALLOC_CTX
*mem_ctx
,
889 struct winbindd_domain
*domain
,
890 const char *domain_name
,
891 const char *name
, DOM_SID
*sid
,
892 enum lsa_SidType
*type
)
897 result
= domain
->methods
->name_to_sid(domain
, mem_ctx
, domain_name
, name
, sid
, type
);
899 /* Return sid and type if lookup successful */
900 if (!NT_STATUS_IS_OK(result
)) {
901 *type
= SID_NAME_UNKNOWN
;
904 return NT_STATUS_IS_OK(result
);
908 * @brief Lookup a name in a domain from a sid.
910 * @param sid Security ID you want to look up.
911 * @param name On success, set to the name corresponding to @p sid.
912 * @param dom_name On success, set to the 'domain name' corresponding to @p sid.
913 * @param type On success, contains the type of name: alias, group or
915 * @retval True if the name exists, in which case @p name and @p type
916 * are set, otherwise False.
918 BOOL
winbindd_lookup_name_by_sid(TALLOC_CTX
*mem_ctx
,
919 struct winbindd_domain
*domain
,
923 enum lsa_SidType
*type
)
932 result
= domain
->methods
->sid_to_name(domain
, mem_ctx
, sid
, dom_name
, name
, type
);
934 /* Return name and type if successful */
936 if (NT_STATUS_IS_OK(result
)) {
940 *type
= SID_NAME_UNKNOWN
;
945 /* Free state information held for {set,get,end}{pw,gr}ent() functions */
947 void free_getent_state(struct getent_state
*state
)
949 struct getent_state
*temp
;
951 /* Iterate over state list */
955 while(temp
!= NULL
) {
956 struct getent_state
*next
;
958 /* Free sam entries then list entry */
960 SAFE_FREE(state
->sam_entries
);
961 DLIST_REMOVE(state
, state
);
969 /* Is this a domain which we may assume no DOMAIN\ prefix? */
971 static BOOL
assume_domain(const char *domain
)
973 /* never assume the domain on a standalone server */
975 if ( lp_server_role() == ROLE_STANDALONE
)
978 /* domain member servers may possibly assume for the domain name */
980 if ( lp_server_role() == ROLE_DOMAIN_MEMBER
) {
981 if ( !strequal(lp_workgroup(), domain
) )
984 if ( lp_winbind_use_default_domain() || lp_winbind_trusted_domains_only() )
988 /* only left with a domain controller */
990 if ( strequal(get_global_sam_name(), domain
) ) {
997 /* Parse a string of the form DOMAIN\user into a domain and a user */
999 BOOL
parse_domain_user(const char *domuser
, fstring domain
, fstring user
)
1001 char *p
= strchr(domuser
,*lp_winbind_separator());
1004 fstrcpy(user
, domuser
);
1006 if ( assume_domain(lp_workgroup())) {
1007 fstrcpy(domain
, lp_workgroup());
1013 fstrcpy(domain
, domuser
);
1014 domain
[PTR_DIFF(p
, domuser
)] = 0;
1022 BOOL
parse_domain_user_talloc(TALLOC_CTX
*mem_ctx
, const char *domuser
,
1023 char **domain
, char **user
)
1025 fstring fstr_domain
, fstr_user
;
1026 if (!parse_domain_user(domuser
, fstr_domain
, fstr_user
)) {
1029 *domain
= talloc_strdup(mem_ctx
, fstr_domain
);
1030 *user
= talloc_strdup(mem_ctx
, fstr_user
);
1031 return ((*domain
!= NULL
) && (*user
!= NULL
));
1034 /* Ensure an incoming username from NSS is fully qualified. Replace the
1035 incoming fstring with DOMAIN <separator> user. Returns the same
1036 values as parse_domain_user() but also replaces the incoming username.
1037 Used to ensure all names are fully qualified within winbindd.
1038 Used by the NSS protocols of auth, chauthtok, logoff and ccache_ntlm_auth.
1039 The protocol definitions of auth_crap, chng_pswd_auth_crap
1040 really should be changed to use this instead of doing things
1043 BOOL
canonicalize_username(fstring username_inout
, fstring domain
, fstring user
)
1045 if (!parse_domain_user(username_inout
, domain
, user
)) {
1048 slprintf(username_inout
, sizeof(fstring
) - 1, "%s%c%s",
1049 domain
, *lp_winbind_separator(),
1055 Fill DOMAIN\\USERNAME entry accounting 'winbind use default domain' and
1056 'winbind separator' options.
1058 - omit DOMAIN when 'winbind use default domain = true' and DOMAIN is
1061 If we are a PDC or BDC, and this is for our domain, do likewise.
1063 Also, if omit DOMAIN if 'winbind trusted domains only = true', as the
1064 username is then unqualified in unix
1066 We always canonicalize as UPPERCASE DOMAIN, lowercase username.
1068 void fill_domain_username(fstring name
, const char *domain
, const char *user
, BOOL can_assume
)
1072 fstrcpy(tmp_user
, user
);
1073 strlower_m(tmp_user
);
1075 if (can_assume
&& assume_domain(domain
)) {
1076 strlcpy(name
, tmp_user
, sizeof(fstring
));
1078 slprintf(name
, sizeof(fstring
) - 1, "%s%c%s",
1079 domain
, *lp_winbind_separator(),
1085 * Winbindd socket accessor functions
1088 char *get_winbind_priv_pipe_dir(void)
1090 return lock_path(WINBINDD_PRIV_SOCKET_SUBDIR
);
1094 * Client list accessor functions
1097 static struct winbindd_cli_state
*_client_list
;
1098 static int _num_clients
;
1100 /* Return list of all connected clients */
1102 struct winbindd_cli_state
*winbindd_client_list(void)
1104 return _client_list
;
1107 /* Add a connection to the list */
1109 void winbindd_add_client(struct winbindd_cli_state
*cli
)
1111 DLIST_ADD(_client_list
, cli
);
1115 /* Remove a client from the list */
1117 void winbindd_remove_client(struct winbindd_cli_state
*cli
)
1119 DLIST_REMOVE(_client_list
, cli
);
1123 /* Close all open clients */
1125 void winbindd_kill_all_clients(void)
1127 struct winbindd_cli_state
*cl
= winbindd_client_list();
1129 DEBUG(10, ("winbindd_kill_all_clients: going postal\n"));
1132 struct winbindd_cli_state
*next
;
1135 winbindd_remove_client(cl
);
1140 /* Return number of open clients */
1142 int winbindd_num_clients(void)
1144 return _num_clients
;
1147 NTSTATUS
lookup_usergroups_cached(struct winbindd_domain
*domain
,
1148 TALLOC_CTX
*mem_ctx
,
1149 const DOM_SID
*user_sid
,
1150 uint32
*p_num_groups
, DOM_SID
**user_sids
)
1152 NET_USER_INFO_3
*info3
= NULL
;
1153 NTSTATUS status
= NT_STATUS_NO_MEMORY
;
1155 size_t num_groups
= 0;
1156 DOM_SID group_sid
, primary_group
;
1158 DEBUG(3,(": lookup_usergroups_cached\n"));
1164 info3
= netsamlogon_cache_get(mem_ctx
, user_sid
);
1166 if (info3
== NULL
) {
1167 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1170 if (info3
->num_groups
== 0) {
1172 return NT_STATUS_UNSUCCESSFUL
;
1175 /* always add the primary group to the sid array */
1176 sid_compose(&primary_group
, &info3
->dom_sid
.sid
, info3
->user_rid
);
1178 if (!add_sid_to_array(mem_ctx
, &primary_group
, user_sids
, &num_groups
)) {
1180 return NT_STATUS_NO_MEMORY
;
1183 for (i
=0; i
<info3
->num_groups
; i
++) {
1184 sid_copy(&group_sid
, &info3
->dom_sid
.sid
);
1185 sid_append_rid(&group_sid
, info3
->gids
[i
].g_rid
);
1187 if (!add_sid_to_array(mem_ctx
, &group_sid
, user_sids
,
1190 return NT_STATUS_NO_MEMORY
;
1195 *p_num_groups
= num_groups
;
1196 status
= (user_sids
!= NULL
) ? NT_STATUS_OK
: NT_STATUS_NO_MEMORY
;
1198 DEBUG(3,(": lookup_usergroups_cached succeeded\n"));
1203 /*********************************************************************
1204 We use this to remove spaces from user and group names
1205 ********************************************************************/
1207 void ws_name_replace( char *name
, char replace
)
1209 char replace_char
[2] = { 0x0, 0x0 };
1211 if ( !lp_winbind_normalize_names() || (replace
== '\0') )
1214 replace_char
[0] = replace
;
1215 all_string_sub( name
, " ", replace_char
, 0 );
1220 /*********************************************************************
1221 We use this to do the inverse of ws_name_replace()
1222 ********************************************************************/
1224 void ws_name_return( char *name
, char replace
)
1226 char replace_char
[2] = { 0x0, 0x0 };
1228 if ( !lp_winbind_normalize_names() || (replace
== '\0') )
1231 replace_char
[0] = replace
;
1232 all_string_sub( name
, replace_char
, " ", 0 );