2 Unix SMB/CIFS implementation.
6 Copyright (C) Tim Potter 2000
7 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
8 Copyright (C) Simo Sorce 2003
9 Copyright (C) Gerald Carter 2003
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 2 of the License, or
14 (at your option) any later version.
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
21 You should have received a copy of the GNU General Public License
22 along with this program; if not, write to the Free Software
23 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
29 #define DBGC_CLASS DBGC_IDMAP
31 struct ldap_connection
*ldap_conn
= NULL
;
33 /* number tries while allocating new id */
34 #define LDAP_MAX_ALLOC_ID 128
37 /***********************************************************************
38 This function cannot be called to modify a mapping, only set a new one
39 ***********************************************************************/
41 static NTSTATUS
ldap_set_mapping(const DOM_SID
*sid
, unid_t id
, int id_type
)
43 NTSTATUS ret
= NT_STATUS_UNSUCCESSFUL
;
47 struct ldap_message
*msg
;
48 struct ldap_message
*mod_res
= NULL
;
51 type
= (id_type
& ID_USERID
) ? "uidNumber" : "gidNumber";
53 sid_to_string( sid_string
, sid
);
55 pstr_sprintf(id_str
, "%lu",
56 ((id_type
& ID_USERID
) ?
57 (unsigned long)id
.uid
: (unsigned long)id
.gid
));
60 "dn: sambaSID=%s,%s\n"
62 "objectClass: sambaIdmapEntry\n"
63 "objectClass: sambaSidEntry\n"
66 sid_string
, lp_ldap_idmap_suffix(), sid_string
, type
,
67 ((id_type
& ID_USERID
) ?
68 (unsigned long)id
.uid
: (unsigned long)id
.gid
));
70 msg
= ldap_ldif2msg(mod
);
75 return NT_STATUS_NO_MEMORY
;
77 mod_res
= ldap_transaction(ldap_conn
, msg
);
79 if ((mod_res
== NULL
) || (mod_res
->r
.ModifyResponse
.resultcode
!= 0))
84 destroy_ldap_message(msg
);
85 destroy_ldap_message(mod_res
);
89 /*****************************************************************************
90 Allocate a new uid or gid
91 *****************************************************************************/
93 static NTSTATUS
ldap_allocate_id(unid_t
*id
, int id_type
)
95 NTSTATUS ret
= NT_STATUS_UNSUCCESSFUL
;
98 const char *attrs
[] = { "uidNumber", "gidNumber" };
99 struct ldap_message
*idpool_s
= NULL
;
100 struct ldap_message
*idpool
= NULL
;
101 struct ldap_message
*mod_msg
= NULL
;
102 struct ldap_message
*mod_res
= NULL
;
104 const char *id_attrib
;
107 id_attrib
= (id_type
& ID_USERID
) ? "uidNumber" : "gidNumber";
109 idpool_s
= new_ldap_search_message(lp_ldap_suffix(),
110 LDAP_SEARCH_SCOPE_SUB
,
111 "(objectclass=sambaUnixIdPool)",
114 if (idpool_s
== NULL
)
115 return NT_STATUS_NO_MEMORY
;
117 idpool
= ldap_searchone(ldap_conn
, idpool_s
, NULL
);
122 if (!ldap_find_single_int(idpool
, id_attrib
, &value
))
125 /* this must succeed or else we wouldn't have initialized */
127 lp_idmap_uid( &luid
, &huid
);
128 lp_idmap_gid( &lgid
, &hgid
);
130 /* make sure we still have room to grow */
132 if (id_type
& ID_USERID
) {
134 if (id
->uid
> huid
) {
135 DEBUG(0,("ldap_allocate_id: Cannot allocate uid "
136 "above %lu!\n", (unsigned long)huid
));
142 if (id
->gid
> hgid
) {
143 DEBUG(0,("ldap_allocate_id: Cannot allocate gid "
144 "above %lu!\n", (unsigned long)hgid
));
151 "changetype: modify\n"
157 idpool
->r
.SearchResultEntry
.dn
, id_attrib
, id_attrib
, value
,
158 id_attrib
, id_attrib
, value
+1);
160 mod_msg
= ldap_ldif2msg(mod
);
167 mod_res
= ldap_transaction(ldap_conn
, mod_msg
);
169 if ((mod_res
== NULL
) || (mod_res
->r
.ModifyResponse
.resultcode
!= 0))
174 destroy_ldap_message(idpool_s
);
175 destroy_ldap_message(idpool
);
176 destroy_ldap_message(mod_msg
);
177 destroy_ldap_message(mod_res
);
182 /*****************************************************************************
184 *****************************************************************************/
186 static NTSTATUS
ldap_get_sid_from_id(DOM_SID
*sid
, unid_t id
, int id_type
)
190 NTSTATUS ret
= NT_STATUS_UNSUCCESSFUL
;
191 const char *attr_list
[] = { "sambaSID" };
192 struct ldap_message
*msg
;
193 struct ldap_message
*entry
= NULL
;
196 type
= (id_type
& ID_USERID
) ? "uidNumber" : "gidNumber";
198 pstr_sprintf(filter
, "(&(objectClass=%s)(%s=%lu))", "sambaIdmapEntry",
200 ((id_type
& ID_USERID
) ?
201 (unsigned long)id
.uid
: (unsigned long)id
.gid
));
203 msg
= new_ldap_search_message(lp_ldap_idmap_suffix(),
204 LDAP_SEARCH_SCOPE_SUB
,
205 filter
, 1, attr_list
);
208 return NT_STATUS_NO_MEMORY
;
210 entry
= ldap_searchone(ldap_conn
, msg
, NULL
);
215 if (!ldap_find_single_string(entry
, "sambaSID", entry
->mem_ctx
,
219 if (!string_to_sid(sid
, sid_str
))
224 destroy_ldap_message(msg
);
225 destroy_ldap_message(entry
);
230 /***********************************************************************
232 ***********************************************************************/
234 static NTSTATUS
ldap_get_id_from_sid(unid_t
*id
, int *id_type
,
239 NTSTATUS ret
= NT_STATUS_UNSUCCESSFUL
;
240 struct ldap_message
*msg
;
241 struct ldap_message
*entry
= NULL
;
244 DEBUG(8,("ldap_get_id_from_sid: %s (%s)\n", sid_string_static(sid
),
245 (*id_type
& ID_GROUPID
? "group" : "user") ));
247 type
= ((*id_type
) & ID_USERID
) ? "uidNumber" : "gidNumber";
249 pstr_sprintf(filter
, "(&(objectClass=%s)(%s=%s))",
250 "sambaIdmapEntry", "sambaSID", sid_string_static(sid
));
252 msg
= new_ldap_search_message(lp_ldap_idmap_suffix(),
253 LDAP_SEARCH_SCOPE_SUB
,
257 return NT_STATUS_NO_MEMORY
;
259 entry
= ldap_searchone(ldap_conn
, msg
, NULL
);
264 if (!ldap_find_single_int(entry
, type
, &value
))
267 if ((*id_type
) & ID_USERID
)
276 if ((*id_type
) & ID_QUERY_ONLY
)
279 /* Allocate a new RID */
281 for (i
= 0; i
< LDAP_MAX_ALLOC_ID
; i
++) {
282 ret
= ldap_allocate_id(id
, *id_type
);
283 if ( NT_STATUS_IS_OK(ret
) )
287 if ( !NT_STATUS_IS_OK(ret
) ) {
288 DEBUG(0,("Could not allocate id\n"));
292 DEBUG(10,("ldap_get_id_from_sid: Allocated new %cid [%ul]\n",
293 (*id_type
& ID_GROUPID
? 'g' : 'u'), (uint32
)id
->uid
));
295 ret
= ldap_set_mapping(sid
, *id
, *id_type
);
298 destroy_ldap_message(msg
);
299 destroy_ldap_message(entry
);
304 /**********************************************************************
305 Verify the sambaUnixIdPool entry in the directory.
306 **********************************************************************/
307 static NTSTATUS
verify_idpool(void)
309 const char *attr_list
[3] = { "uidnumber", "gidnumber", "objectclass" };
312 struct ldap_message
*msg
, *entry
, *res
;
317 msg
= new_ldap_search_message(lp_ldap_suffix(),
318 LDAP_SEARCH_SCOPE_SUB
,
319 "(objectClass=sambaUnixIdPool)",
323 return NT_STATUS_NO_MEMORY
;
325 entry
= ldap_searchone(ldap_conn
, msg
, NULL
);
327 result
= (entry
!= NULL
);
329 destroy_ldap_message(msg
);
330 destroy_ldap_message(entry
);
335 if ( !lp_idmap_uid(&luid
, &huid
) || !lp_idmap_gid( &lgid
, &hgid
) ) {
336 DEBUG(3,("ldap_idmap_init: idmap uid/gid parameters not "
338 return NT_STATUS_UNSUCCESSFUL
;
343 "changetype: modify\n"
345 "objectClass: sambaUnixIdPool\n"
352 lp_ldap_idmap_suffix(),
353 (unsigned long)luid
, (unsigned long)lgid
);
355 msg
= ldap_ldif2msg(mod
);
360 return NT_STATUS_NO_MEMORY
;
362 res
= ldap_transaction(ldap_conn
, msg
);
364 if ((res
== NULL
) || (res
->r
.ModifyResponse
.resultcode
!= 0)) {
365 destroy_ldap_message(msg
);
366 destroy_ldap_message(res
);
367 DEBUG(5, ("Could not add sambaUnixIdPool\n"));
368 return NT_STATUS_UNSUCCESSFUL
;
371 destroy_ldap_message(msg
);
372 destroy_ldap_message(res
);
376 /*****************************************************************************
377 Initialise idmap database.
378 *****************************************************************************/
380 static NTSTATUS
ldap_idmap_init( char *params
)
385 ldap_conn
= new_ldap_connection();
387 if (!fetch_ldap_pw(&dn
, &pw
))
388 return NT_STATUS_UNSUCCESSFUL
;
390 ldap_conn
->auth_dn
= talloc_strdup(ldap_conn
->mem_ctx
, dn
);
391 ldap_conn
->simple_pw
= talloc_strdup(ldap_conn
->mem_ctx
, pw
);
396 if (!ldap_setup_connection(ldap_conn
, params
, NULL
, NULL
))
397 return NT_STATUS_UNSUCCESSFUL
;
399 /* see if the idmap suffix and sub entries exists */
401 nt_status
= verify_idpool();
402 if ( !NT_STATUS_IS_OK(nt_status
) )
408 /*****************************************************************************
410 *****************************************************************************/
412 static NTSTATUS
ldap_idmap_close(void)
415 DEBUG(5,("The connection to the LDAP server was closed\n"));
416 /* maybe free the results here --metze */
422 /* This function doesn't make as much sense in an LDAP world since the calling
423 node doesn't really control the ID ranges */
424 static void ldap_idmap_status(void)
426 DEBUG(0, ("LDAP IDMAP Status not available\n"));
429 static struct idmap_methods ldap_methods
= {
432 ldap_get_sid_from_id
,
433 ldap_get_id_from_sid
,
440 NTSTATUS
idmap_smbldap_init(void)
442 return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION
, "smbldap", &ldap_methods
);