?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Allow reinit_after_fork to be called safely from within swat and other binaries that...
[Samba.git] / source / winbindd / winbindd_ads.c
blobc1301585b3469b53d0062933244ca0aa5c92ded4
1 /*
2 Unix SMB/CIFS implementation.
3
4 Winbind ADS backend functions
5
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
8 Copyright (C) Gerald (Jerry) Carter 2004
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 */
23
24 #include "includes.h"
25 #include "winbindd.h"
26
27 #ifdef HAVE_ADS
28
29 #undef DBGC_CLASS
30 #define DBGC_CLASS DBGC_WINBIND
31
32 extern struct winbindd_methods reconnect_methods;
33
34 /*
35 return our ads connections structure for a domain. We keep the connection
36 open to make things faster
37 */
38 static ADS_STRUCT *ads_cached_connection(struct winbindd_domain *domain)
39 {
40 ADS_STRUCT *ads;
41 ADS_STATUS status;
42 fstring dc_name;
43 struct sockaddr_storage dc_ss;
44
45 DEBUG(10,("ads_cached_connection\n"));
46
47 if (domain->private_data) {
48
49 time_t expire;
50 time_t now = time(NULL);
51
52 /* check for a valid structure */
53 ads = (ADS_STRUCT *)domain->private_data;
54
55 expire = MIN(ads->auth.tgt_expire, ads->auth.tgs_expire);
56
57 DEBUG(7, ("Current tickets expire in %d seconds (at %d, time is now %d)\n",
58 (uint32)expire-(uint32)now, (uint32) expire, (uint32) now));
59
60 if ( ads->config.realm && (expire > now)) {
61 return ads;
62 } else {
63 /* we own this ADS_STRUCT so make sure it goes away */
64 DEBUG(7,("Deleting expired krb5 credential cache\n"));
65 ads->is_mine = True;
66 ads_destroy( &ads );
67 ads_kdestroy("MEMORY:winbind_ccache");
68 domain->private_data = NULL;
69 }
70 }
71
72 /* we don't want this to affect the users ccache */
73 setenv("KRB5CCNAME", "MEMORY:winbind_ccache", 1);
74
75 ads = ads_init(domain->alt_name, domain->name, NULL);
76 if (!ads) {
77 DEBUG(1,("ads_init for domain %s failed\n", domain->name));
78 return NULL;
79 }
80
81 /* the machine acct password might have change - fetch it every time */
82
83 SAFE_FREE(ads->auth.password);
84 SAFE_FREE(ads->auth.realm);
85
86 if ( IS_DC ) {
87 DOM_SID sid;
88 time_t last_set_time;
89
90 if ( !pdb_get_trusteddom_pw( domain->name, &ads->auth.password, &sid, &last_set_time ) ) {
91 ads_destroy( &ads );
92 return NULL;
93 }
94 ads->auth.realm = SMB_STRDUP( ads->server.realm );
95 strupper_m( ads->auth.realm );
96 }
97 else {
98 struct winbindd_domain *our_domain = domain;
99
100 ads->auth.password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
101
102 /* always give preference to the alt_name in our
103 primary domain if possible */
104
105 if ( !domain->primary )
106 our_domain = find_our_domain();
107
108 if ( our_domain->alt_name[0] != '\0' ) {
109 ads->auth.realm = SMB_STRDUP( our_domain->alt_name );
110 strupper_m( ads->auth.realm );
111 }
112 else
113 ads->auth.realm = SMB_STRDUP( lp_realm() );
114 }
115
116 ads->auth.renewable = WINBINDD_PAM_AUTH_KRB5_RENEW_TIME;
117
118 /* Setup the server affinity cache. We don't reaally care
119 about the name. Just setup affinity and the KRB5_CONFIG
120 file. */
121
122 get_dc_name( ads->server.workgroup, ads->server.realm, dc_name, &dc_ss );
123
124 status = ads_connect(ads);
125 if (!ADS_ERR_OK(status) || !ads->config.realm) {
126 DEBUG(1,("ads_connect for domain %s failed: %s\n",
127 domain->name, ads_errstr(status)));
128 ads_destroy(&ads);
129
130 /* if we get ECONNREFUSED then it might be a NT4
131 server, fall back to MSRPC */
132 if (status.error_type == ENUM_ADS_ERROR_SYSTEM &&
133 status.err.rc == ECONNREFUSED) {
134 /* 'reconnect_methods' is the MS-RPC backend. */
135 DEBUG(1,("Trying MSRPC methods\n"));
136 domain->backend = &reconnect_methods;
137 }
138 return NULL;
139 }
140
141 /* set the flag that says we don't own the memory even
142 though we do so that ads_destroy() won't destroy the
143 structure we pass back by reference */
144
145 ads->is_mine = False;
146
147 domain->private_data = (void *)ads;
148 return ads;
149 }
150
151
152 /* Query display info for a realm. This is the basic user list fn */
153 static NTSTATUS query_user_list(struct winbindd_domain *domain,
154 TALLOC_CTX *mem_ctx,
155 uint32 *num_entries,
156 WINBIND_USERINFO **info)
157 {
158 ADS_STRUCT *ads = NULL;
159 const char *attrs[] = { "*", NULL };
160 int i, count;
161 ADS_STATUS rc;
162 LDAPMessage *res = NULL;
163 LDAPMessage *msg = NULL;
164 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
165
166 *num_entries = 0;
167
168 DEBUG(3,("ads: query_user_list\n"));
169
170 if ( !winbindd_can_contact_domain( domain ) ) {
171 DEBUG(10,("query_user_list: No incoming trust for domain %s\n",
172 domain->name));
173 return NT_STATUS_OK;
174 }
175
176 ads = ads_cached_connection(domain);
177
178 if (!ads) {
179 domain->last_status = NT_STATUS_SERVER_DISABLED;
180 goto done;
181 }
182
183 rc = ads_search_retry(ads, &res, "(objectCategory=user)", attrs);
184 if (!ADS_ERR_OK(rc) || !res) {
185 DEBUG(1,("query_user_list ads_search: %s\n", ads_errstr(rc)));
186 goto done;
187 }
188
189 count = ads_count_replies(ads, res);
190 if (count == 0) {
191 DEBUG(1,("query_user_list: No users found\n"));
192 goto done;
193 }
194
195 (*info) = TALLOC_ZERO_ARRAY(mem_ctx, WINBIND_USERINFO, count);
196 if (!*info) {
197 status = NT_STATUS_NO_MEMORY;
198 goto done;
199 }
200
201 i = 0;
202
203 for (msg = ads_first_entry(ads, res); msg; msg = ads_next_entry(ads, msg)) {
204 char *name, *gecos = NULL;
205 char *homedir = NULL;
206 char *shell = NULL;
207 uint32 group;
208 uint32 atype;
209 DOM_SID user_sid;
210 gid_t primary_gid = (gid_t)-1;
211
212 if (!ads_pull_uint32(ads, msg, "sAMAccountType", &atype) ||
213 ads_atype_map(atype) != SID_NAME_USER) {
214 DEBUG(1,("Not a user account? atype=0x%x\n", atype));
215 continue;
216 }
217
218 name = ads_pull_username(ads, mem_ctx, msg);
219
220 if ( ads_pull_sid( ads, msg, "objectSid", &user_sid ) ) {
221 status = nss_get_info_cached( domain, &user_sid, mem_ctx,
222 ads, msg, &homedir, &shell, &gecos,
223 &primary_gid );
224 }
225
226 if (gecos == NULL) {
227 gecos = ads_pull_string(ads, mem_ctx, msg, "name");
228 }
229
230 if (!ads_pull_sid(ads, msg, "objectSid",
231 &(*info)[i].user_sid)) {
232 DEBUG(1,("No sid for %s !?\n", name));
233 continue;
234 }
235 if (!ads_pull_uint32(ads, msg, "primaryGroupID", &group)) {
236 DEBUG(1,("No primary group for %s !?\n", name));
237 continue;
238 }
239
240 (*info)[i].acct_name = name;
241 (*info)[i].full_name = gecos;
242 (*info)[i].homedir = homedir;
243 (*info)[i].shell = shell;
244 (*info)[i].primary_gid = primary_gid;
245 sid_compose(&(*info)[i].group_sid, &domain->sid, group);
246 i++;
247 }
248
249 (*num_entries) = i;
250 status = NT_STATUS_OK;
251
252 DEBUG(3,("ads query_user_list gave %d entries\n", (*num_entries)));
253
254 done:
255 if (res)
256 ads_msgfree(ads, res);
257
258 return status;
259 }
260
261 /* list all domain groups */
262 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
263 TALLOC_CTX *mem_ctx,
264 uint32 *num_entries,
265 struct acct_info **info)
266 {
267 ADS_STRUCT *ads = NULL;
268 const char *attrs[] = {"userPrincipalName", "sAMAccountName",
269 "name", "objectSid", NULL};
270 int i, count;
271 ADS_STATUS rc;
272 LDAPMessage *res = NULL;
273 LDAPMessage *msg = NULL;
274 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
275 const char *filter;
276 bool enum_dom_local_groups = False;
277
278 *num_entries = 0;
279
280 DEBUG(3,("ads: enum_dom_groups\n"));
281
282 if ( !winbindd_can_contact_domain( domain ) ) {
283 DEBUG(10,("enum_dom_groups: No incoming trust for domain %s\n",
284 domain->name));
285 return NT_STATUS_OK;
286 }
287
288 /* only grab domain local groups for our domain */
289 if ( domain->active_directory && strequal(lp_realm(), domain->alt_name) ) {
290 enum_dom_local_groups = True;
291 }
292
293 /* Workaround ADS LDAP bug present in MS W2K3 SP0 and W2K SP4 w/o
294 * rollup-fixes:
295 *
296 * According to Section 5.1(4) of RFC 2251 if a value of a type is it's
297 * default value, it MUST be absent. In case of extensible matching the
298 * "dnattr" boolean defaults to FALSE and so it must be only be present
299 * when set to TRUE.
300 *
301 * When it is set to FALSE and the OpenLDAP lib (correctly) encodes a
302 * filter using bitwise matching rule then the buggy AD fails to decode
303 * the extensible match. As a workaround set it to TRUE and thereby add
304 * the dnAttributes "dn" field to cope with those older AD versions.
305 * It should not harm and won't put any additional load on the AD since
306 * none of the dn components have a bitmask-attribute.
307 *
308 * Thanks to Ralf Haferkamp for input and testing - Guenther */
309
310 filter = talloc_asprintf(mem_ctx, "(&(objectCategory=group)(&(groupType:dn:%s:=%d)(!(groupType:dn:%s:=%d))))",
311 ADS_LDAP_MATCHING_RULE_BIT_AND, GROUP_TYPE_SECURITY_ENABLED,
312 ADS_LDAP_MATCHING_RULE_BIT_AND,
313 enum_dom_local_groups ? GROUP_TYPE_BUILTIN_LOCAL_GROUP : GROUP_TYPE_RESOURCE_GROUP);
314
315 if (filter == NULL) {
316 status = NT_STATUS_NO_MEMORY;
317 goto done;
318 }
319
320 ads = ads_cached_connection(domain);
321
322 if (!ads) {
323 domain->last_status = NT_STATUS_SERVER_DISABLED;
324 goto done;
325 }
326
327 rc = ads_search_retry(ads, &res, filter, attrs);
328 if (!ADS_ERR_OK(rc) || !res) {
329 DEBUG(1,("enum_dom_groups ads_search: %s\n", ads_errstr(rc)));
330 goto done;
331 }
332
333 count = ads_count_replies(ads, res);
334 if (count == 0) {
335 DEBUG(1,("enum_dom_groups: No groups found\n"));
336 goto done;
337 }
338
339 (*info) = TALLOC_ZERO_ARRAY(mem_ctx, struct acct_info, count);
340 if (!*info) {
341 status = NT_STATUS_NO_MEMORY;
342 goto done;
343 }
344
345 i = 0;
346
347 for (msg = ads_first_entry(ads, res); msg; msg = ads_next_entry(ads, msg)) {
348 char *name, *gecos;
349 DOM_SID sid;
350 uint32 rid;
351
352 name = ads_pull_username(ads, mem_ctx, msg);
353 gecos = ads_pull_string(ads, mem_ctx, msg, "name");
354 if (!ads_pull_sid(ads, msg, "objectSid", &sid)) {
355 DEBUG(1,("No sid for %s !?\n", name));
356 continue;
357 }
358
359 if (!sid_peek_check_rid(&domain->sid, &sid, &rid)) {
360 DEBUG(1,("No rid for %s !?\n", name));
361 continue;
362 }
363
364 fstrcpy((*info)[i].acct_name, name);
365 fstrcpy((*info)[i].acct_desc, gecos);
366 (*info)[i].rid = rid;
367 i++;
368 }
369
370 (*num_entries) = i;
371
372 status = NT_STATUS_OK;
373
374 DEBUG(3,("ads enum_dom_groups gave %d entries\n", (*num_entries)));
375
376 done:
377 if (res)
378 ads_msgfree(ads, res);
379
380 return status;
381 }
382
383 /* list all domain local groups */
384 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
385 TALLOC_CTX *mem_ctx,
386 uint32 *num_entries,
387 struct acct_info **info)
388 {
389 /*
390 * This is a stub function only as we returned the domain
391 * local groups in enum_dom_groups() if the domain->native field
392 * was true. This is a simple performance optimization when
393 * using LDAP.
394 *
395 * if we ever need to enumerate domain local groups separately,
396 * then this optimization in enum_dom_groups() will need
397 * to be split out
398 */
399 *num_entries = 0;
400
401 return NT_STATUS_OK;
402 }
403
404 /* convert a single name to a sid in a domain - use rpc methods */
405 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
406 TALLOC_CTX *mem_ctx,
407 enum winbindd_cmd orig_cmd,
408 const char *domain_name,
409 const char *name,
410 DOM_SID *sid,
411 enum lsa_SidType *type)
412 {
413 return reconnect_methods.name_to_sid(domain, mem_ctx, orig_cmd,
414 domain_name, name,
415 sid, type);
416 }
417
418 /* convert a domain SID to a user or group name - use rpc methods */
419 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
420 TALLOC_CTX *mem_ctx,
421 const DOM_SID *sid,
422 char **domain_name,
423 char **name,
424 enum lsa_SidType *type)
425 {
426 return reconnect_methods.sid_to_name(domain, mem_ctx, sid,
427 domain_name, name, type);
428 }
429
430 /* convert a list of rids to names - use rpc methods */
431 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
432 TALLOC_CTX *mem_ctx,
433 const DOM_SID *sid,
434 uint32 *rids,
435 size_t num_rids,
436 char **domain_name,
437 char ***names,
438 enum lsa_SidType **types)
439 {
440 return reconnect_methods.rids_to_names(domain, mem_ctx, sid,
441 rids, num_rids,
442 domain_name, names, types);
443 }
444
445 /* If you are looking for "dn_lookup": Yes, it used to be here!
446 * It has gone now since it was a major speed bottleneck in
447 * lookup_groupmem (its only use). It has been replaced by
448 * an rpc lookup sids call... R.I.P. */
449
450 /* Lookup user information from a rid */
451 static NTSTATUS query_user(struct winbindd_domain *domain,
452 TALLOC_CTX *mem_ctx,
453 const DOM_SID *sid,
454 WINBIND_USERINFO *info)
455 {
456 ADS_STRUCT *ads = NULL;
457 const char *attrs[] = { "*", NULL };
458 ADS_STATUS rc;
459 int count;
460 LDAPMessage *msg = NULL;
461 char *ldap_exp;
462 char *sidstr;
463 uint32 group_rid;
464 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
465 struct netr_SamInfo3 *user = NULL;
466
467 DEBUG(3,("ads: query_user\n"));
468
469 info->homedir = NULL;
470 info->shell = NULL;
471 info->primary_gid = (gid_t)-1;
472
473 /* try netsamlogon cache first */
474
475 if ( (user = netsamlogon_cache_get( mem_ctx, sid )) != NULL )
476 {
477
478 DEBUG(5,("query_user: Cache lookup succeeded for %s\n",
479 sid_string_dbg(sid)));
480
481 sid_compose(&info->user_sid, &domain->sid, user->base.rid);
482 sid_compose(&info->group_sid, &domain->sid, user->base.primary_gid);
483
484 info->acct_name = talloc_strdup(mem_ctx, user->base.account_name.string);
485 info->full_name = talloc_strdup(mem_ctx, user->base.full_name.string);
486
487 nss_get_info_cached( domain, sid, mem_ctx, NULL, NULL,
488 &info->homedir, &info->shell, &info->full_name,
489 &info->primary_gid );
490
491 TALLOC_FREE(user);
492
493 return NT_STATUS_OK;
494 }
495
496 if ( !winbindd_can_contact_domain(domain)) {
497 DEBUG(8,("query_user: No incoming trust from domain %s\n",
498 domain->name));
499
500 /* We still need to generate some basic information
501 about the user even if we cannot contact the
502 domain. Most of this stuff we can deduce. */
503
504 sid_copy( &info->user_sid, sid );
505
506 /* Assume "Domain Users" for the primary group */
507
508 sid_compose(&info->group_sid, &domain->sid, DOMAIN_GROUP_RID_USERS );
509
510 /* Try to fill in what the nss_info backend can do */
511
512 nss_get_info_cached( domain, sid, mem_ctx, NULL, NULL,
513 &info->homedir, &info->shell, &info->full_name,
514 &info->primary_gid );
515
516 status = NT_STATUS_OK;
517 goto done;
518 }
519
520 /* no cache...do the query */
521
522 if ( (ads = ads_cached_connection(domain)) == NULL ) {
523 domain->last_status = NT_STATUS_SERVER_DISABLED;
524 goto done;
525 }
526
527 sidstr = sid_binstring(sid);
528 asprintf(&ldap_exp, "(objectSid=%s)", sidstr);
529 rc = ads_search_retry(ads, &msg, ldap_exp, attrs);
530 free(ldap_exp);
531 free(sidstr);
532 if (!ADS_ERR_OK(rc) || !msg) {
533 DEBUG(1,("query_user(sid=%s) ads_search: %s\n",
534 sid_string_dbg(sid), ads_errstr(rc)));
535 goto done;
536 }
537
538 count = ads_count_replies(ads, msg);
539 if (count != 1) {
540 DEBUG(1,("query_user(sid=%s): Not found\n",
541 sid_string_dbg(sid)));
542 goto done;
543 }
544
545 info->acct_name = ads_pull_username(ads, mem_ctx, msg);
546
547 nss_get_info_cached( domain, sid, mem_ctx, ads, msg,
548 &info->homedir, &info->shell, &info->full_name,
549 &info->primary_gid );
550
551 if (info->full_name == NULL) {
552 info->full_name = ads_pull_string(ads, mem_ctx, msg, "name");
553 }
554
555 if (!ads_pull_uint32(ads, msg, "primaryGroupID", &group_rid)) {
556 DEBUG(1,("No primary group for %s !?\n",
557 sid_string_dbg(sid)));
558 goto done;
559 }
560
561 sid_copy(&info->user_sid, sid);
562 sid_compose(&info->group_sid, &domain->sid, group_rid);
563
564 status = NT_STATUS_OK;
565
566 DEBUG(3,("ads query_user gave %s\n", info->acct_name));
567 done:
568 if (msg)
569 ads_msgfree(ads, msg);
570
571 return status;
572 }
573
574 /* Lookup groups a user is a member of - alternate method, for when
575 tokenGroups are not available. */
576 static NTSTATUS lookup_usergroups_member(struct winbindd_domain *domain,
577 TALLOC_CTX *mem_ctx,
578 const char *user_dn,
579 DOM_SID *primary_group,
580 size_t *p_num_groups, DOM_SID **user_sids)
581 {
582 ADS_STATUS rc;
583 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
584 int count;
585 LDAPMessage *res = NULL;
586 LDAPMessage *msg = NULL;
587 char *ldap_exp;
588 ADS_STRUCT *ads;
589 const char *group_attrs[] = {"objectSid", NULL};
590 char *escaped_dn;
591 size_t num_groups = 0;
592
593 DEBUG(3,("ads: lookup_usergroups_member\n"));
594
595 if ( !winbindd_can_contact_domain( domain ) ) {
596 DEBUG(10,("lookup_usergroups_members: No incoming trust for domain %s\n",
597 domain->name));
598 return NT_STATUS_OK;
599 }
600
601 ads = ads_cached_connection(domain);
602
603 if (!ads) {
604 domain->last_status = NT_STATUS_SERVER_DISABLED;
605 goto done;
606 }
607
608 if (!(escaped_dn = escape_ldap_string_alloc(user_dn))) {
609 status = NT_STATUS_NO_MEMORY;
610 goto done;
611 }
612
613 ldap_exp = talloc_asprintf(mem_ctx,
614 "(&(member=%s)(objectCategory=group)(groupType:dn:%s:=%d))",
615 escaped_dn,
616 ADS_LDAP_MATCHING_RULE_BIT_AND,
617 GROUP_TYPE_SECURITY_ENABLED);
618 if (!ldap_exp) {
619 DEBUG(1,("lookup_usergroups(dn=%s) asprintf failed!\n", user_dn));
620 SAFE_FREE(escaped_dn);
621 status = NT_STATUS_NO_MEMORY;
622 goto done;
623 }
624
625 SAFE_FREE(escaped_dn);
626
627 rc = ads_search_retry(ads, &res, ldap_exp, group_attrs);
628
629 if (!ADS_ERR_OK(rc) || !res) {
630 DEBUG(1,("lookup_usergroups ads_search member=%s: %s\n", user_dn, ads_errstr(rc)));
631 return ads_ntstatus(rc);
632 }
633
634 count = ads_count_replies(ads, res);
635
636 *user_sids = NULL;
637 num_groups = 0;
638
639 /* always add the primary group to the sid array */
640 status = add_sid_to_array(mem_ctx, primary_group, user_sids,
641 &num_groups);
642 if (!NT_STATUS_IS_OK(status)) {
643 goto done;
644 }
645
646 if (count > 0) {
647 for (msg = ads_first_entry(ads, res); msg;
648 msg = ads_next_entry(ads, msg)) {
649 DOM_SID group_sid;
650
651 if (!ads_pull_sid(ads, msg, "objectSid", &group_sid)) {
652 DEBUG(1,("No sid for this group ?!?\n"));
653 continue;
654 }
655
656 /* ignore Builtin groups from ADS - Guenther */
657 if (sid_check_is_in_builtin(&group_sid)) {
658 continue;
659 }
660
661 status = add_sid_to_array(mem_ctx, &group_sid,
662 user_sids, &num_groups);
663 if (!NT_STATUS_IS_OK(status)) {
664 goto done;
665 }
666 }
667
668 }
669
670 *p_num_groups = num_groups;
671 status = (user_sids != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
672
673 DEBUG(3,("ads lookup_usergroups (member) succeeded for dn=%s\n", user_dn));
674 done:
675 if (res)
676 ads_msgfree(ads, res);
677
678 return status;
679 }
680
681 /* Lookup groups a user is a member of - alternate method, for when
682 tokenGroups are not available. */
683 static NTSTATUS lookup_usergroups_memberof(struct winbindd_domain *domain,
684 TALLOC_CTX *mem_ctx,
685 const char *user_dn,
686 DOM_SID *primary_group,
687 size_t *p_num_groups,
688 DOM_SID **user_sids)
689 {
690 ADS_STATUS rc;
691 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
692 ADS_STRUCT *ads;
693 const char *attrs[] = {"memberOf", NULL};
694 size_t num_groups = 0;
695 DOM_SID *group_sids = NULL;
696 int i;
697 char **strings = NULL;
698 size_t num_strings = 0, num_sids = 0;
699
700
701 DEBUG(3,("ads: lookup_usergroups_memberof\n"));
702
703 if ( !winbindd_can_contact_domain( domain ) ) {
704 DEBUG(10,("lookup_usergroups_memberof: No incoming trust for "
705 "domain %s\n", domain->name));
706 return NT_STATUS_OK;
707 }
708
709 ads = ads_cached_connection(domain);
710
711 if (!ads) {
712 domain->last_status = NT_STATUS_SERVER_DISABLED;
713 return NT_STATUS_UNSUCCESSFUL;
714 }
715
716 rc = ads_search_retry_extended_dn_ranged(ads, mem_ctx, user_dn, attrs,
717 ADS_EXTENDED_DN_HEX_STRING,
718 &strings, &num_strings);
719
720 if (!ADS_ERR_OK(rc)) {
721 DEBUG(1,("lookup_usergroups_memberof ads_search "
722 "member=%s: %s\n", user_dn, ads_errstr(rc)));
723 return ads_ntstatus(rc);
724 }
725
726 *user_sids = NULL;
727 num_groups = 0;
728
729 /* always add the primary group to the sid array */
730 status = add_sid_to_array(mem_ctx, primary_group, user_sids,
731 &num_groups);
732 if (!NT_STATUS_IS_OK(status)) {
733 goto done;
734 }
735
736 group_sids = TALLOC_ZERO_ARRAY(mem_ctx, DOM_SID, num_strings + 1);
737 if (!group_sids) {
738 status = NT_STATUS_NO_MEMORY;
739 goto done;
740 }
741
742 for (i=0; i<num_strings; i++) {
743 rc = ads_get_sid_from_extended_dn(mem_ctx, strings[i],
744 ADS_EXTENDED_DN_HEX_STRING,
745 &(group_sids)[i]);
746 if (!ADS_ERR_OK(rc)) {
747 /* ignore members without SIDs */
748 if (NT_STATUS_EQUAL(ads_ntstatus(rc),
749 NT_STATUS_NOT_FOUND)) {
750 continue;
751 }
752 else {
753 status = ads_ntstatus(rc);
754 goto done;
755 }
756 }
757 num_sids++;
758 }
759
760 if (i == 0) {
761 DEBUG(1,("No memberOf for this user?!?\n"));
762 status = NT_STATUS_NO_MEMORY;
763 goto done;
764 }
765
766 for (i=0; i<num_sids; i++) {
767
768 /* ignore Builtin groups from ADS - Guenther */
769 if (sid_check_is_in_builtin(&group_sids[i])) {
770 continue;
771 }
772
773 status = add_sid_to_array(mem_ctx, &group_sids[i], user_sids,
774 &num_groups);
775 if (!NT_STATUS_IS_OK(status)) {
776 goto done;
777 }
778
779 }
780
781 *p_num_groups = num_groups;
782 status = (*user_sids != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
783
784 DEBUG(3,("ads lookup_usergroups (memberof) succeeded for dn=%s\n",
785 user_dn));
786
787 done:
788 TALLOC_FREE(strings);
789 TALLOC_FREE(group_sids);
790
791 return status;
792 }
793
794
795 /* Lookup groups a user is a member of. */
796 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
797 TALLOC_CTX *mem_ctx,
798 const DOM_SID *sid,
799 uint32 *p_num_groups, DOM_SID **user_sids)
800 {
801 ADS_STRUCT *ads = NULL;
802 const char *attrs[] = {"tokenGroups", "primaryGroupID", NULL};
803 ADS_STATUS rc;
804 int count;
805 LDAPMessage *msg = NULL;
806 char *user_dn = NULL;
807 DOM_SID *sids;
808 int i;
809 DOM_SID primary_group;
810 uint32 primary_group_rid;
811 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
812 size_t num_groups = 0;
813
814 DEBUG(3,("ads: lookup_usergroups\n"));
815 *p_num_groups = 0;
816
817 status = lookup_usergroups_cached(domain, mem_ctx, sid,
818 p_num_groups, user_sids);
819 if (NT_STATUS_IS_OK(status)) {
820 return NT_STATUS_OK;
821 }
822
823 if ( !winbindd_can_contact_domain( domain ) ) {
824 DEBUG(10,("lookup_usergroups: No incoming trust for domain %s\n",
825 domain->name));
826
827 /* Tell the cache manager not to remember this one */
828
829 return NT_STATUS_SYNCHRONIZATION_REQUIRED;
830 }
831
832 ads = ads_cached_connection(domain);
833
834 if (!ads) {
835 domain->last_status = NT_STATUS_SERVER_DISABLED;
836 status = NT_STATUS_SERVER_DISABLED;
837 goto done;
838 }
839
840 rc = ads_search_retry_sid(ads, &msg, sid, attrs);
841
842 if (!ADS_ERR_OK(rc)) {
843 status = ads_ntstatus(rc);
844 DEBUG(1, ("lookup_usergroups(sid=%s) ads_search tokenGroups: "
845 "%s\n", sid_string_dbg(sid), ads_errstr(rc)));
846 goto done;
847 }
848
849 count = ads_count_replies(ads, msg);
850 if (count != 1) {
851 status = NT_STATUS_UNSUCCESSFUL;
852 DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: "
853 "invalid number of results (count=%d)\n",
854 sid_string_dbg(sid), count));
855 goto done;
856 }
857
858 if (!msg) {
859 DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: NULL msg\n",
860 sid_string_dbg(sid)));
861 status = NT_STATUS_UNSUCCESSFUL;
862 goto done;
863 }
864
865 user_dn = ads_get_dn(ads, msg);
866 if (user_dn == NULL) {
867 status = NT_STATUS_NO_MEMORY;
868 goto done;
869 }
870
871 if (!ads_pull_uint32(ads, msg, "primaryGroupID", &primary_group_rid)) {
872 DEBUG(1,("%s: No primary group for sid=%s !?\n",
873 domain->name, sid_string_dbg(sid)));
874 goto done;
875 }
876
877 sid_copy(&primary_group, &domain->sid);
878 sid_append_rid(&primary_group, primary_group_rid);
879
880 count = ads_pull_sids(ads, mem_ctx, msg, "tokenGroups", &sids);
881
882 /* there must always be at least one group in the token,
883 unless we are talking to a buggy Win2k server */
884
885 /* actually this only happens when the machine account has no read
886 * permissions on the tokenGroup attribute - gd */
887
888 if (count == 0) {
889
890 /* no tokenGroups */
891
892 /* lookup what groups this user is a member of by DN search on
893 * "memberOf" */
894
895 status = lookup_usergroups_memberof(domain, mem_ctx, user_dn,
896 &primary_group,
897 &num_groups, user_sids);
898 *p_num_groups = (uint32)num_groups;
899 if (NT_STATUS_IS_OK(status)) {
900 goto done;
901 }
902
903 /* lookup what groups this user is a member of by DN search on
904 * "member" */
905
906 status = lookup_usergroups_member(domain, mem_ctx, user_dn,
907 &primary_group,
908 &num_groups, user_sids);
909 *p_num_groups = (uint32)num_groups;
910 goto done;
911 }
912
913 *user_sids = NULL;
914 num_groups = 0;
915
916 status = add_sid_to_array(mem_ctx, &primary_group, user_sids,
917 &num_groups);
918 if (!NT_STATUS_IS_OK(status)) {
919 goto done;
920 }
921
922 for (i=0;i<count;i++) {
923
924 /* ignore Builtin groups from ADS - Guenther */
925 if (sid_check_is_in_builtin(&sids[i])) {
926 continue;
927 }
928
929 status = add_sid_to_array_unique(mem_ctx, &sids[i],
930 user_sids, &num_groups);
931 if (!NT_STATUS_IS_OK(status)) {
932 goto done;
933 }
934 }
935
936 *p_num_groups = (uint32)num_groups;
937 status = (*user_sids != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
938
939 DEBUG(3,("ads lookup_usergroups (tokenGroups) succeeded for sid=%s\n",
940 sid_string_dbg(sid)));
941 done:
942 ads_memfree(ads, user_dn);
943 ads_msgfree(ads, msg);
944 return status;
945 }
946
947 /* Lookup aliases a user is member of - use rpc methods */
948 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
949 TALLOC_CTX *mem_ctx,
950 uint32 num_sids, const DOM_SID *sids,
951 uint32 *num_aliases, uint32 **alias_rids)
952 {
953 return reconnect_methods.lookup_useraliases(domain, mem_ctx,
954 num_sids, sids,
955 num_aliases,
956 alias_rids);
957 }
958
959 /*
960 find the members of a group, given a group rid and domain
961 */
962 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
963 TALLOC_CTX *mem_ctx,
964 const DOM_SID *group_sid, uint32 *num_names,
965 DOM_SID **sid_mem, char ***names,
966 uint32 **name_types)
967 {
968 ADS_STATUS rc;
969 ADS_STRUCT *ads = NULL;
970 char *ldap_exp;
971 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
972 char *sidbinstr;
973 char **members = NULL;
974 int i;
975 size_t num_members = 0;
976 ads_control args;
977 struct rpc_pipe_client *cli;
978 POLICY_HND lsa_policy;
979 DOM_SID *sid_mem_nocache = NULL;
980 char **names_nocache = NULL;
981 enum lsa_SidType *name_types_nocache = NULL;
982 char **domains_nocache = NULL; /* only needed for rpccli_lsa_lookup_sids */
983 uint32 num_nocache = 0;
984 TALLOC_CTX *tmp_ctx = NULL;
985
986 DEBUG(10,("ads: lookup_groupmem %s sid=%s\n", domain->name,
987 sid_string_dbg(group_sid)));
988
989 *num_names = 0;
990
991 tmp_ctx = talloc_new(mem_ctx);
992 if (!tmp_ctx) {
993 DEBUG(1, ("ads: lookup_groupmem: talloc failed\n"));
994 status = NT_STATUS_NO_MEMORY;
995 goto done;
996 }
997
998 if ( !winbindd_can_contact_domain( domain ) ) {
999 DEBUG(10,("lookup_groupmem: No incoming trust for domain %s\n",
1000 domain->name));
1001 return NT_STATUS_OK;
1002 }
1003
1004 ads = ads_cached_connection(domain);
1005
1006 if (!ads) {
1007 domain->last_status = NT_STATUS_SERVER_DISABLED;
1008 goto done;
1009 }
1010
1011 if ((sidbinstr = sid_binstring(group_sid)) == NULL) {
1012 status = NT_STATUS_NO_MEMORY;
1013 goto done;
1014 }
1015
1016 /* search for all members of the group */
1017 if (!(ldap_exp = talloc_asprintf(tmp_ctx, "(objectSid=%s)",
1018 sidbinstr)))
1019 {
1020 SAFE_FREE(sidbinstr);
1021 DEBUG(1, ("ads: lookup_groupmem: talloc_asprintf for ldap_exp failed!\n"));
1022 status = NT_STATUS_NO_MEMORY;
1023 goto done;
1024 }
1025 SAFE_FREE(sidbinstr);
1026
1027 args.control = ADS_EXTENDED_DN_OID;
1028 args.val = ADS_EXTENDED_DN_HEX_STRING;
1029 args.critical = True;
1030
1031 rc = ads_ranged_search(ads, tmp_ctx, LDAP_SCOPE_SUBTREE, ads->config.bind_path,
1032 ldap_exp, &args, "member", &members, &num_members);
1033
1034 if (!ADS_ERR_OK(rc)) {
1035 DEBUG(0,("ads_ranged_search failed with: %s\n", ads_errstr(rc)));
1036 status = NT_STATUS_UNSUCCESSFUL;
1037 goto done;
1038 }
1039
1040 DEBUG(10, ("ads lookup_groupmem: got %d sids via extended dn call\n", (int)num_members));
1041
1042 /* Now that we have a list of sids, we need to get the
1043 * lists of names and name_types belonging to these sids.
1044 * even though conceptually not quite clean, we use the
1045 * RPC call lsa_lookup_sids for this since it can handle a
1046 * list of sids. ldap calls can just resolve one sid at a time.
1047 *
1048 * At this stage, the sids are still hidden in the exetended dn
1049 * member output format. We actually do a little better than
1050 * stated above: In extracting the sids from the member strings,
1051 * we try to resolve as many sids as possible from the
1052 * cache. Only the rest is passed to the lsa_lookup_sids call. */
1053
1054 if (num_members) {
1055 (*sid_mem) = TALLOC_ZERO_ARRAY(mem_ctx, DOM_SID, num_members);
1056 (*names) = TALLOC_ZERO_ARRAY(mem_ctx, char *, num_members);
1057 (*name_types) = TALLOC_ZERO_ARRAY(mem_ctx, uint32, num_members);
1058 (sid_mem_nocache) = TALLOC_ZERO_ARRAY(tmp_ctx, DOM_SID, num_members);
1059
1060 if ((members == NULL) || (*sid_mem == NULL) ||
1061 (*names == NULL) || (*name_types == NULL) ||
1062 (sid_mem_nocache == NULL))
1063 {
1064 DEBUG(1, ("ads: lookup_groupmem: talloc failed\n"));
1065 status = NT_STATUS_NO_MEMORY;
1066 goto done;
1067 }
1068 }
1069 else {
1070 (*sid_mem) = NULL;
1071 (*names) = NULL;
1072 (*name_types) = NULL;
1073 }
1074
1075 for (i=0; i<num_members; i++) {
1076 enum lsa_SidType name_type;
1077 char *name, *domain_name;
1078 DOM_SID sid;
1079
1080 rc = ads_get_sid_from_extended_dn(tmp_ctx, members[i], args.val,
1081 &sid);
1082 if (!ADS_ERR_OK(rc)) {
1083 if (NT_STATUS_EQUAL(ads_ntstatus(rc),
1084 NT_STATUS_NOT_FOUND)) {
1085 /* Group members can be objects, like Exchange
1086 * Public Folders, that don't have a SID. Skip
1087 * them. */
1088 continue;
1089 }
1090 else {
1091 status = ads_ntstatus(rc);
1092 goto done;
1093 }
1094 }
1095 if (lookup_cached_sid(mem_ctx, &sid, &domain_name, &name,
1096 &name_type)) {
1097 DEBUG(10,("ads: lookup_groupmem: got sid %s from "
1098 "cache\n", sid_string_dbg(&sid)));
1099 sid_copy(&(*sid_mem)[*num_names], &sid);
1100 (*names)[*num_names] = fill_domain_username_talloc(
1101 *names,
1102 domain_name,
1103 name,
1104 true);
1105
1106 (*name_types)[*num_names] = name_type;
1107 (*num_names)++;
1108 }
1109 else {
1110 DEBUG(10, ("ads: lookup_groupmem: sid %s not found in "
1111 "cache\n", sid_string_dbg(&sid)));
1112 sid_copy(&(sid_mem_nocache)[num_nocache], &sid);
1113 num_nocache++;
1114 }
1115 }
1116
1117 DEBUG(10, ("ads: lookup_groupmem: %d sids found in cache, "
1118 "%d left for lsa_lookupsids\n", *num_names, num_nocache));
1119
1120 /* handle sids not resolved from cache by lsa_lookup_sids */
1121 if (num_nocache > 0) {
1122
1123 status = cm_connect_lsa(domain, tmp_ctx, &cli, &lsa_policy);
1124
1125 if (!NT_STATUS_IS_OK(status)) {
1126 goto done;
1127 }
1128
1129 status = rpccli_lsa_lookup_sids(cli, tmp_ctx,
1130 &lsa_policy,
1131 num_nocache,
1132 sid_mem_nocache,
1133 &domains_nocache,
1134 &names_nocache,
1135 &name_types_nocache);
1136
1137 if (!(NT_STATUS_IS_OK(status) ||
1138 NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED) ||
1139 NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)))
1140 {
1141 DEBUG(1, ("lsa_lookupsids call failed with %s "
1142 "- retrying...\n", nt_errstr(status)));
1143
1144 status = cm_connect_lsa(domain, tmp_ctx, &cli,
1145 &lsa_policy);
1146
1147 if (!NT_STATUS_IS_OK(status)) {
1148 goto done;
1149 }
1150
1151 status = rpccli_lsa_lookup_sids(cli, tmp_ctx,
1152 &lsa_policy,
1153 num_nocache,
1154 sid_mem_nocache,
1155 &domains_nocache,
1156 &names_nocache,
1157 &name_types_nocache);
1158 }
1159
1160 if (NT_STATUS_IS_OK(status) ||
1161 NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED))
1162 {
1163 /* Copy the entries over from the "_nocache" arrays
1164 * to the result arrays, skipping the gaps the
1165 * lookup_sids call left. */
1166 for (i=0; i < num_nocache; i++) {
1167 if (((names_nocache)[i] != NULL) &&
1168 ((name_types_nocache)[i] != SID_NAME_UNKNOWN))
1169 {
1170 sid_copy(&(*sid_mem)[*num_names],
1171 &sid_mem_nocache[i]);
1172 (*names)[*num_names] =
1173 fill_domain_username_talloc(
1174 *names,
1175 domains_nocache[i],
1176 names_nocache[i],
1177 true);
1178 (*name_types)[*num_names] = name_types_nocache[i];
1179 (*num_names)++;
1180 }
1181 }
1182 }
1183 else if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1184 DEBUG(10, ("lookup_groupmem: lsa_lookup_sids could "
1185 "not map any SIDs at all.\n"));
1186 /* Don't handle this as an error here.
1187 * There is nothing left to do with respect to the
1188 * overall result... */
1189 }
1190 else if (!NT_STATUS_IS_OK(status)) {
1191 DEBUG(10, ("lookup_groupmem: Error looking up %d "
1192 "sids via rpc_lsa_lookup_sids: %s\n",
1193 (int)num_members, nt_errstr(status)));
1194 goto done;
1195 }
1196 }
1197
1198 status = NT_STATUS_OK;
1199 DEBUG(3,("ads lookup_groupmem for sid=%s succeeded\n",
1200 sid_string_dbg(group_sid)));
1201
1202 done:
1203
1204 TALLOC_FREE(tmp_ctx);
1205
1206 return status;
1207 }
1208
1209 /* find the sequence number for a domain */
1210 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
1211 {
1212 ADS_STRUCT *ads = NULL;
1213 ADS_STATUS rc;
1214
1215 DEBUG(3,("ads: fetch sequence_number for %s\n", domain->name));
1216
1217 if ( !winbindd_can_contact_domain( domain ) ) {
1218 DEBUG(10,("sequence: No incoming trust for domain %s\n",
1219 domain->name));
1220 *seq = time(NULL);
1221 return NT_STATUS_OK;
1222 }
1223
1224 *seq = DOM_SEQUENCE_NONE;
1225
1226 ads = ads_cached_connection(domain);
1227
1228 if (!ads) {
1229 domain->last_status = NT_STATUS_SERVER_DISABLED;
1230 return NT_STATUS_UNSUCCESSFUL;
1231 }
1232
1233 rc = ads_USN(ads, seq);
1234
1235 if (!ADS_ERR_OK(rc)) {
1236
1237 /* its a dead connection, destroy it */
1238
1239 if (domain->private_data) {
1240 ads = (ADS_STRUCT *)domain->private_data;
1241 ads->is_mine = True;
1242 ads_destroy(&ads);
1243 ads_kdestroy("MEMORY:winbind_ccache");
1244 domain->private_data = NULL;
1245 }
1246 }
1247 return ads_ntstatus(rc);
1248 }
1249
1250 /* find the lockout policy of a domain - use rpc methods */
1251 static NTSTATUS lockout_policy(struct winbindd_domain *domain,
1252 TALLOC_CTX *mem_ctx,
1253 struct samr_DomInfo12 *policy)
1254 {
1255 return reconnect_methods.lockout_policy(domain, mem_ctx, policy);
1256 }
1257
1258 /* find the password policy of a domain - use rpc methods */
1259 static NTSTATUS password_policy(struct winbindd_domain *domain,
1260 TALLOC_CTX *mem_ctx,
1261 struct samr_DomInfo1 *policy)
1262 {
1263 return reconnect_methods.password_policy(domain, mem_ctx, policy);
1264 }
1265
1266 /* get a list of trusted domains */
1267 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
1268 TALLOC_CTX *mem_ctx,
1269 uint32 *num_domains,
1270 char ***names,
1271 char ***alt_names,
1272 DOM_SID **dom_sids)
1273 {
1274 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1275 struct netr_DomainTrustList trusts;
1276 int i;
1277 uint32 flags;
1278 struct rpc_pipe_client *cli;
1279 uint32 fr_flags = (NETR_TRUST_FLAG_IN_FOREST | NETR_TRUST_FLAG_TREEROOT);
1280 int ret_count;
1281
1282 DEBUG(3,("ads: trusted_domains\n"));
1283
1284 *num_domains = 0;
1285 *alt_names = NULL;
1286 *names = NULL;
1287 *dom_sids = NULL;
1288
1289 /* If this is our primary domain or a root in our forest,
1290 query for all trusts. If not, then just look for domain
1291 trusts in the target forest */
1292
1293 if ( domain->primary ||
1294 ((domain->domain_flags&fr_flags) == fr_flags) )
1295 {
1296 flags = NETR_TRUST_FLAG_OUTBOUND |
1297 NETR_TRUST_FLAG_INBOUND |
1298 NETR_TRUST_FLAG_IN_FOREST;
1299 } else {
1300 flags = NETR_TRUST_FLAG_IN_FOREST;
1301 }
1302
1303 result = cm_connect_netlogon(domain, &cli);
1304
1305 if (!NT_STATUS_IS_OK(result)) {
1306 DEBUG(5, ("trusted_domains: Could not open a connection to %s "
1307 "for PIPE_NETLOGON (%s)\n",
1308 domain->name, nt_errstr(result)));
1309 return NT_STATUS_UNSUCCESSFUL;
1310 }
1311
1312 result = rpccli_netr_DsrEnumerateDomainTrusts(cli, mem_ctx,
1313 cli->cli->desthost,
1314 flags,
1315 &trusts,
1316 NULL);
1317 if ( NT_STATUS_IS_OK(result) && trusts.count) {
1318
1319 /* Allocate memory for trusted domain names and sids */
1320
1321 if ( !(*names = TALLOC_ARRAY(mem_ctx, char *, trusts.count)) ) {
1322 DEBUG(0, ("trusted_domains: out of memory\n"));
1323 return NT_STATUS_NO_MEMORY;
1324 }
1325
1326 if ( !(*alt_names = TALLOC_ARRAY(mem_ctx, char *, trusts.count)) ) {
1327 DEBUG(0, ("trusted_domains: out of memory\n"));
1328 return NT_STATUS_NO_MEMORY;
1329 }
1330
1331 if ( !(*dom_sids = TALLOC_ARRAY(mem_ctx, DOM_SID, trusts.count)) ) {
1332 DEBUG(0, ("trusted_domains: out of memory\n"));
1333 return NT_STATUS_NO_MEMORY;
1334 }
1335
1336 /* Copy across names and sids */
1337
1338
1339 ret_count = 0;
1340 for (i = 0; i < trusts.count; i++) {
1341 struct winbindd_domain d;
1342
1343 ZERO_STRUCT(d);
1344
1345 /* drop external trusts if this is not our primary
1346 domain. This means that the returned number of
1347 domains may be less that the ones actually trusted
1348 by the DC. */
1349
1350 if ( (trusts.array[i].trust_attributes == NETR_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN) &&
1351 !domain->primary )
1352 {
1353 DEBUG(10,("trusted_domains: Skipping external trusted domain "
1354 "%s because it is outside of our primary domain\n",
1355 trusts.array[i].netbios_name));
1356 continue;
1357 }
1358
1359 (*names)[ret_count] = CONST_DISCARD(char *, trusts.array[i].netbios_name);
1360 (*alt_names)[ret_count] = CONST_DISCARD(char *, trusts.array[i].dns_name);
1361 if (trusts.array[i].sid) {
1362 sid_copy(&(*dom_sids)[ret_count], trusts.array[i].sid);
1363 } else {
1364 sid_copy(&(*dom_sids)[ret_count], &global_sid_NULL);
1365 }
1366
1367 /* add to the trusted domain cache */
1368
1369 fstrcpy( d.name, trusts.array[i].netbios_name);
1370 fstrcpy( d.alt_name, trusts.array[i].dns_name);
1371 if (trusts.array[i].sid) {
1372 sid_copy( &d.sid, trusts.array[i].sid);
1373 } else {
1374 sid_copy(&d.sid, &global_sid_NULL);
1375 }
1376
1377 if ( domain->primary ) {
1378 DEBUG(10,("trusted_domains(ads): Searching "
1379 "trusted domain list of %s and storing "
1380 "trust flags for domain %s\n",
1381 domain->name, d.alt_name));
1382
1383 d.domain_flags = trusts.array[i].trust_flags;
1384 d.domain_type = trusts.array[i].trust_type;
1385 d.domain_trust_attribs = trusts.array[i].trust_attributes;
1386
1387 wcache_tdc_add_domain( &d );
1388 ret_count++;
1389 } else if ( (domain->domain_flags&fr_flags) == fr_flags ) {
1390 /* Check if we already have this record. If
1391 * we are following our forest root that is not
1392 * our primary domain, we want to keep trust
1393 * flags from the perspective of our primary
1394 * domain not our forest root. */
1395 struct winbindd_tdc_domain *exist = NULL;
1396
1397 exist =
1398 wcache_tdc_fetch_domain(NULL, trusts.array[i].netbios_name);
1399 if (!exist) {
1400 DEBUG(10,("trusted_domains(ads): Searching "
1401 "trusted domain list of %s and storing "
1402 "trust flags for domain %s\n",
1403 domain->name, d.alt_name));
1404 d.domain_flags = trusts.array[i].trust_flags;
1405 d.domain_type = trusts.array[i].trust_type;
1406 d.domain_trust_attribs = trusts.array[i].trust_attributes;
1407
1408 wcache_tdc_add_domain( &d );
1409 ret_count++;
1410 }
1411 TALLOC_FREE(exist);
1412 } else {
1413 /* This gets a little tricky. If we are
1414 following a transitive forest trust, then
1415 innerit the flags, type, and attribs from
1416 the domain we queried to make sure we don't
1417 record the view of the trust from the wrong
1418 side. Always view it from the side of our
1419 primary domain. --jerry */
1420 struct winbindd_tdc_domain *parent = NULL;
1421
1422 DEBUG(10,("trusted_domains(ads): Searching "
1423 "trusted domain list of %s and inheriting "
1424 "trust flags for domain %s\n",
1425 domain->name, d.alt_name));
1426
1427 parent = wcache_tdc_fetch_domain(NULL, domain->name);
1428 if (parent) {
1429 d.domain_flags = parent->trust_flags;
1430 d.domain_type = parent->trust_type;
1431 d.domain_trust_attribs = parent->trust_attribs;
1432 } else {
1433 d.domain_flags = domain->domain_flags;
1434 d.domain_type = domain->domain_type;
1435 d.domain_trust_attribs = domain->domain_trust_attribs;
1436 }
1437 TALLOC_FREE(parent);
1438
1439 wcache_tdc_add_domain( &d );
1440 ret_count++;
1441 }
1442 }
1443
1444 *num_domains = ret_count;
1445 }
1446
1447 return result;
1448 }
1449
1450 /* the ADS backend methods are exposed via this structure */
1451 struct winbindd_methods ads_methods = {
1452 True,
1453 query_user_list,
1454 enum_dom_groups,
1455 enum_local_groups,
1456 name_to_sid,
1457 sid_to_name,
1458 rids_to_names,
1459 query_user,
1460 lookup_usergroups,
1461 lookup_useraliases,
1462 lookup_groupmem,
1463 sequence_number,
1464 lockout_policy,
1465 password_policy,
1466 trusted_domains,
1467 };
1468
1469 #endif
Samba GIT mirror