r19784: smbd compiles (still a few warning which are actual bugs)
[Samba.git] / source / sam / idmap_smbldap.c
blob4d80364437cb000bb6eabaad28c01d987cdd3f4b
1 /*
2 Unix SMB/CIFS implementation.
4 idmap LDAP backend
6 Copyright (C) Tim Potter 2000
7 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
8 Copyright (C) Simo Sorce 2003
9 Copyright (C) Gerald Carter 2003
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 2 of the License, or
14 (at your option) any later version.
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
21 You should have received a copy of the GNU General Public License
22 along with this program; if not, write to the Free Software
23 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 #include "includes.h"
28 #undef DBGC_CLASS
29 #define DBGC_CLASS DBGC_IDMAP
31 struct ldap_connection *ldap_conn = NULL;
33 /* number tries while allocating new id */
34 #define LDAP_MAX_ALLOC_ID 128
37 /***********************************************************************
38 This function cannot be called to modify a mapping, only set a new one
39 ***********************************************************************/
41 static NTSTATUS ldap_set_mapping(const DOM_SID *sid, unid_t id, int id_type)
43 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
44 pstring id_str;
45 const char *type;
46 fstring sid_string;
47 struct ldap_message *msg;
48 struct ldap_message *mod_res = NULL;
49 char *mod;
51 type = (id_type & ID_USERID) ? "uidNumber" : "gidNumber";
53 sid_to_string( sid_string, sid );
55 pstr_sprintf(id_str, "%lu",
56 ((id_type & ID_USERID) ?
57 (unsigned long)id.uid : (unsigned long)id.gid));
59 asprintf(&mod,
60 "dn: sambaSID=%s,%s\n"
61 "changetype: add\n"
62 "objectClass: sambaIdmapEntry\n"
63 "objectClass: sambaSidEntry\n"
64 "sambaSID: %s\n"
65 "%s: %lu\n",
66 sid_string, lp_ldap_idmap_suffix(), sid_string, type,
67 ((id_type & ID_USERID) ?
68 (unsigned long)id.uid : (unsigned long)id.gid));
70 msg = ldap_ldif2msg(mod);
72 SAFE_FREE(mod);
74 if (msg == NULL)
75 return NT_STATUS_NO_MEMORY;
77 mod_res = ldap_transaction(ldap_conn, msg);
79 if ((mod_res == NULL) || (mod_res->r.ModifyResponse.resultcode != 0))
80 goto out;
82 ret = NT_STATUS_OK;
83 out:
84 destroy_ldap_message(msg);
85 destroy_ldap_message(mod_res);
86 return ret;
89 /*****************************************************************************
90 Allocate a new uid or gid
91 *****************************************************************************/
93 static NTSTATUS ldap_allocate_id(unid_t *id, int id_type)
95 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
96 uid_t luid, huid;
97 gid_t lgid, hgid;
98 const char *attrs[] = { "uidNumber", "gidNumber" };
99 struct ldap_message *idpool_s = NULL;
100 struct ldap_message *idpool = NULL;
101 struct ldap_message *mod_msg = NULL;
102 struct ldap_message *mod_res = NULL;
103 int value;
104 const char *id_attrib;
105 char *mod;
107 id_attrib = (id_type & ID_USERID) ? "uidNumber" : "gidNumber";
109 idpool_s = new_ldap_search_message(lp_ldap_suffix(),
110 LDAP_SEARCH_SCOPE_SUB,
111 "(objectclass=sambaUnixIdPool)",
112 2, attrs);
114 if (idpool_s == NULL)
115 return NT_STATUS_NO_MEMORY;
117 idpool = ldap_searchone(ldap_conn, idpool_s, NULL);
119 if (idpool == NULL)
120 goto out;
122 if (!ldap_find_single_int(idpool, id_attrib, &value))
123 goto out;
125 /* this must succeed or else we wouldn't have initialized */
127 lp_idmap_uid( &luid, &huid);
128 lp_idmap_gid( &lgid, &hgid);
130 /* make sure we still have room to grow */
132 if (id_type & ID_USERID) {
133 id->uid = value;
134 if (id->uid > huid ) {
135 DEBUG(0,("ldap_allocate_id: Cannot allocate uid "
136 "above %lu!\n", (unsigned long)huid));
137 goto out;
140 else {
141 id->gid = value;
142 if (id->gid > hgid ) {
143 DEBUG(0,("ldap_allocate_id: Cannot allocate gid "
144 "above %lu!\n", (unsigned long)hgid));
145 goto out;
149 asprintf(&mod,
150 "dn: %s\n"
151 "changetype: modify\n"
152 "delete: %s\n"
153 "%s: %d\n"
154 "-\n"
155 "add: %s\n"
156 "%s: %d\n",
157 idpool->r.SearchResultEntry.dn, id_attrib, id_attrib, value,
158 id_attrib, id_attrib, value+1);
160 mod_msg = ldap_ldif2msg(mod);
162 SAFE_FREE(mod);
164 if (mod_msg == NULL)
165 goto out;
167 mod_res = ldap_transaction(ldap_conn, mod_msg);
169 if ((mod_res == NULL) || (mod_res->r.ModifyResponse.resultcode != 0))
170 goto out;
172 ret = NT_STATUS_OK;
173 out:
174 destroy_ldap_message(idpool_s);
175 destroy_ldap_message(idpool);
176 destroy_ldap_message(mod_msg);
177 destroy_ldap_message(mod_res);
179 return ret;
182 /*****************************************************************************
183 get a sid from an id
184 *****************************************************************************/
186 static NTSTATUS ldap_get_sid_from_id(DOM_SID *sid, unid_t id, int id_type)
188 pstring filter;
189 const char *type;
190 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
191 const char *attr_list[] = { "sambaSID" };
192 struct ldap_message *msg;
193 struct ldap_message *entry = NULL;
194 char *sid_str;
196 type = (id_type & ID_USERID) ? "uidNumber" : "gidNumber";
198 pstr_sprintf(filter, "(&(objectClass=%s)(%s=%lu))", "sambaIdmapEntry",
199 type,
200 ((id_type & ID_USERID) ?
201 (unsigned long)id.uid : (unsigned long)id.gid));
203 msg = new_ldap_search_message(lp_ldap_idmap_suffix(),
204 LDAP_SEARCH_SCOPE_SUB,
205 filter, 1, attr_list);
207 if (msg == NULL)
208 return NT_STATUS_NO_MEMORY;
210 entry = ldap_searchone(ldap_conn, msg, NULL);
212 if (entry == NULL)
213 goto out;
215 if (!ldap_find_single_string(entry, "sambaSID", entry->mem_ctx,
216 &sid_str))
217 goto out;
219 if (!string_to_sid(sid, sid_str))
220 goto out;
222 ret = NT_STATUS_OK;
223 out:
224 destroy_ldap_message(msg);
225 destroy_ldap_message(entry);
227 return ret;
230 /***********************************************************************
231 Get an id from a sid
232 ***********************************************************************/
234 static NTSTATUS ldap_get_id_from_sid(unid_t *id, int *id_type,
235 const DOM_SID *sid)
237 pstring filter;
238 const char *type;
239 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
240 struct ldap_message *msg;
241 struct ldap_message *entry = NULL;
242 int i;
244 DEBUG(8,("ldap_get_id_from_sid: %s (%s)\n", sid_string_static(sid),
245 (*id_type & ID_GROUPID ? "group" : "user") ));
247 type = ((*id_type) & ID_USERID) ? "uidNumber" : "gidNumber";
249 pstr_sprintf(filter, "(&(objectClass=%s)(%s=%s))",
250 "sambaIdmapEntry", "sambaSID", sid_string_static(sid));
252 msg = new_ldap_search_message(lp_ldap_idmap_suffix(),
253 LDAP_SEARCH_SCOPE_SUB,
254 filter, 1, &type);
256 if (msg == NULL)
257 return NT_STATUS_NO_MEMORY;
259 entry = ldap_searchone(ldap_conn, msg, NULL);
261 if (entry != NULL) {
262 int value;
264 if (!ldap_find_single_int(entry, type, &value))
265 goto out;
267 if ((*id_type) & ID_USERID)
268 id->uid = value;
269 else
270 id->gid = value;
272 ret = NT_STATUS_OK;
273 goto out;
276 if ((*id_type) & ID_QUERY_ONLY)
277 goto out;
279 /* Allocate a new RID */
281 for (i = 0; i < LDAP_MAX_ALLOC_ID; i++) {
282 ret = ldap_allocate_id(id, *id_type);
283 if ( NT_STATUS_IS_OK(ret) )
284 break;
287 if ( !NT_STATUS_IS_OK(ret) ) {
288 DEBUG(0,("Could not allocate id\n"));
289 goto out;
292 DEBUG(10,("ldap_get_id_from_sid: Allocated new %cid [%ul]\n",
293 (*id_type & ID_GROUPID ? 'g' : 'u'), (uint32)id->uid ));
295 ret = ldap_set_mapping(sid, *id, *id_type);
297 out:
298 destroy_ldap_message(msg);
299 destroy_ldap_message(entry);
301 return ret;
304 /**********************************************************************
305 Verify the sambaUnixIdPool entry in the directory.
306 **********************************************************************/
307 static NTSTATUS verify_idpool(void)
309 const char *attr_list[3] = { "uidnumber", "gidnumber", "objectclass" };
310 BOOL result;
311 char *mod;
312 struct ldap_message *msg, *entry, *res;
314 uid_t luid, huid;
315 gid_t lgid, hgid;
317 msg = new_ldap_search_message(lp_ldap_suffix(),
318 LDAP_SEARCH_SCOPE_SUB,
319 "(objectClass=sambaUnixIdPool)",
320 3, attr_list);
322 if (msg == NULL)
323 return NT_STATUS_NO_MEMORY;
325 entry = ldap_searchone(ldap_conn, msg, NULL);
327 result = (entry != NULL);
329 destroy_ldap_message(msg);
330 destroy_ldap_message(entry);
332 if (result)
333 return NT_STATUS_OK;
335 if ( !lp_idmap_uid(&luid, &huid) || !lp_idmap_gid( &lgid, &hgid ) ) {
336 DEBUG(3,("ldap_idmap_init: idmap uid/gid parameters not "
337 "specified\n"));
338 return NT_STATUS_UNSUCCESSFUL;
341 asprintf(&mod,
342 "dn: %s\n"
343 "changetype: modify\n"
344 "add: objectClass\n"
345 "objectClass: sambaUnixIdPool\n"
346 "-\n"
347 "add: uidNumber\n"
348 "uidNumber: %lu\n"
349 "-\n"
350 "add: gidNumber\n"
351 "gidNumber: %lu\n",
352 lp_ldap_idmap_suffix(),
353 (unsigned long)luid, (unsigned long)lgid);
355 msg = ldap_ldif2msg(mod);
357 SAFE_FREE(mod);
359 if (msg == NULL)
360 return NT_STATUS_NO_MEMORY;
362 res = ldap_transaction(ldap_conn, msg);
364 if ((res == NULL) || (res->r.ModifyResponse.resultcode != 0)) {
365 destroy_ldap_message(msg);
366 destroy_ldap_message(res);
367 DEBUG(5, ("Could not add sambaUnixIdPool\n"));
368 return NT_STATUS_UNSUCCESSFUL;
371 destroy_ldap_message(msg);
372 destroy_ldap_message(res);
373 return NT_STATUS_OK;
376 /*****************************************************************************
377 Initialise idmap database.
378 *****************************************************************************/
380 static NTSTATUS ldap_idmap_init( char *params )
382 NTSTATUS nt_status;
383 char *dn, *pw;
385 ldap_conn = new_ldap_connection();
387 if (!fetch_ldap_pw(&dn, &pw))
388 return NT_STATUS_UNSUCCESSFUL;
390 ldap_conn->auth_dn = talloc_strdup(ldap_conn->mem_ctx, dn);
391 ldap_conn->simple_pw = talloc_strdup(ldap_conn->mem_ctx, pw);
393 SAFE_FREE(dn);
394 SAFE_FREE(pw);
396 if (!ldap_setup_connection(ldap_conn, params, NULL, NULL))
397 return NT_STATUS_UNSUCCESSFUL;
399 /* see if the idmap suffix and sub entries exists */
401 nt_status = verify_idpool();
402 if ( !NT_STATUS_IS_OK(nt_status) )
403 return nt_status;
405 return NT_STATUS_OK;
408 /*****************************************************************************
409 End the LDAP session
410 *****************************************************************************/
412 static NTSTATUS ldap_idmap_close(void)
415 DEBUG(5,("The connection to the LDAP server was closed\n"));
416 /* maybe free the results here --metze */
418 return NT_STATUS_OK;
422 /* This function doesn't make as much sense in an LDAP world since the calling
423 node doesn't really control the ID ranges */
424 static void ldap_idmap_status(void)
426 DEBUG(0, ("LDAP IDMAP Status not available\n"));
429 static struct idmap_methods ldap_methods = {
430 ldap_idmap_init,
431 ldap_allocate_id,
432 ldap_get_sid_from_id,
433 ldap_get_id_from_sid,
434 ldap_set_mapping,
435 ldap_idmap_close,
436 ldap_idmap_status
440 NTSTATUS idmap_smbldap_init(void)
442 return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "smbldap", &ldap_methods);