2 * Unix SMB/CIFS implementation.
4 * group mapping code on top of ldb
6 * Copyright (C) Andrew Tridgell 2006
8 * based on tdb group mapping code from groupdb/mapping.c
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 2 of the License, or
13 * (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 #include "groupdb/mapping.h"
27 #include "lib/ldb/include/includes.h"
28 #include "lib/ldb/include/ldb_errors.h"
30 static struct ldb_context
*ldb
;
32 static BOOL
mapping_upgrade(const char *tdb_path
);
35 connect to the group mapping ldb
37 BOOL
init_group_mapping(void)
40 const char *init_ldif
[] =
41 { "dn: @ATTRIBUTES\n" \
42 "ntName: CASE_INSENSITIVE\n" \
45 "@IDXATTR: gidNumber\n" \
46 "@IDXATTR: ntName\n" \
47 "@IDXATTR: memberOf\n" };
48 const char *db_path
, *tdb_path
;
56 /* this is needed as Samba3 doesn't have this globally yet */
59 db_path
= lock_path("group_mapping.ldb");
62 if (ldb
== NULL
) goto failed
;
64 existed
= file_exist(db_path
, NULL
);
66 if (lp_parm_bool(-1, "groupmap", "nosync", False
)) {
67 flags
|= LDB_FLG_NOSYNC
;
70 ret
= ldb_connect(ldb
, db_path
, flags
, NULL
);
71 if (ret
!= LDB_SUCCESS
) {
76 /* initialise the ldb with an index */
77 struct ldb_ldif
*ldif
;
79 for (i
=0;i
<ARRAY_SIZE(init_ldif
);i
++) {
80 ldif
= ldb_ldif_read_string(ldb
, &init_ldif
[i
]);
81 if (ldif
== NULL
) goto failed
;
82 ret
= ldb_add(ldb
, ldif
->msg
);
84 if (ret
== -1) goto failed
;
88 /* possibly upgrade */
89 tdb_path
= lock_path("group_mapping.tdb");
90 if (file_exist(tdb_path
, NULL
) && !mapping_upgrade(tdb_path
)) {
91 unlink(lock_path("group_mapping.ldb"));
98 DEBUG(0,("Failed to open group mapping ldb '%s' - '%s'\n",
99 db_path
, ldb
?ldb_errstring(ldb
):strerror(errno
)));
107 form the DN for a mapping entry from a SID
109 static struct ldb_dn
*mapping_dn(TALLOC_CTX
*mem_ctx
, const DOM_SID
*sid
)
115 sid_copy(&domsid
, sid
);
116 if (!sid_split_rid(&domsid
, &rid
)) {
119 if (!sid_to_string(string_sid
, &domsid
)) {
122 /* we split by domain and rid so we can do a subtree search
123 when we only want one domain */
124 return ldb_dn_string_compose(mem_ctx
, NULL
, "domain=%s,rid=%u",
129 add a group mapping entry
131 BOOL
add_mapping_entry(GROUP_MAP
*map
, int flag
)
133 struct ldb_message
*msg
;
137 if (!init_group_mapping()) {
141 msg
= ldb_msg_new(ldb
);
142 if (msg
== NULL
) return False
;
144 msg
->dn
= mapping_dn(msg
, &map
->sid
);
145 if (msg
->dn
== NULL
) goto failed
;
147 if (ldb_msg_add_string(msg
, "objectClass", "groupMap") != LDB_SUCCESS
||
148 ldb_msg_add_string(msg
, "sid",
149 sid_to_string(string_sid
, &map
->sid
)) != LDB_SUCCESS
||
150 ldb_msg_add_fmt(msg
, "gidNumber", "%u", (unsigned)map
->gid
) != LDB_SUCCESS
||
151 ldb_msg_add_fmt(msg
, "sidNameUse", "%u", (unsigned)map
->sid_name_use
) != LDB_SUCCESS
||
152 ldb_msg_add_string(msg
, "comment", map
->comment
) != LDB_SUCCESS
||
153 ldb_msg_add_string(msg
, "ntName", map
->nt_name
) != LDB_SUCCESS
) {
157 ret
= ldb_add(ldb
, msg
);
159 /* if it exists we update it. This is a hangover from the semantics the
161 if (ret
== LDB_ERR_ENTRY_ALREADY_EXISTS
) {
162 for (i
=0;i
<msg
->num_elements
;i
++) {
163 msg
->elements
[i
].flags
= LDB_FLAG_MOD_REPLACE
;
165 ret
= ldb_modify(ldb
, msg
);
170 return ret
== LDB_SUCCESS
;
178 unpack a ldb message into a GROUP_MAP structure
180 static BOOL
msg_to_group_map(struct ldb_message
*msg
, GROUP_MAP
*map
)
184 map
->gid
= ldb_msg_find_attr_as_int(msg
, "gidNumber", -1);
185 map
->sid_name_use
= ldb_msg_find_attr_as_int(msg
, "sidNameUse", -1);
186 fstrcpy(map
->nt_name
, ldb_msg_find_attr_as_string(msg
, "ntName", NULL
));
187 fstrcpy(map
->comment
, ldb_msg_find_attr_as_string(msg
, "comment", NULL
));
188 sidstr
= ldb_msg_find_attr_as_string(msg
, "sid", NULL
);
190 if (!string_to_sid(&map
->sid
, sidstr
) ||
191 map
->gid
== (gid_t
)-1 ||
192 map
->sid_name_use
== (enum lsa_SidType
)-1) {
193 DEBUG(0,("Unable to unpack group mapping\n"));
201 return a group map entry for a given sid
203 BOOL
get_group_map_from_sid(DOM_SID sid
, GROUP_MAP
*map
)
207 struct ldb_result
*res
=NULL
;
209 if (!init_group_mapping()) {
213 dn
= mapping_dn(ldb
, &sid
);
214 if (dn
== NULL
) goto failed
;
216 ret
= ldb_search(ldb
, dn
, LDB_SCOPE_BASE
, NULL
, NULL
, &res
);
217 talloc_steal(dn
, res
);
218 if (ret
!= LDB_SUCCESS
|| res
->count
!= 1) {
222 if (!msg_to_group_map(res
->msgs
[0], map
)) goto failed
;
233 return a group map entry for a given gid
235 BOOL
get_group_map_from_gid(gid_t gid
, GROUP_MAP
*map
)
239 struct ldb_result
*res
=NULL
;
241 if (!init_group_mapping()) {
245 expr
= talloc_asprintf(ldb
, "(&(gidNumber=%u)(objectClass=groupMap))",
247 if (expr
== NULL
) goto failed
;
249 ret
= ldb_search(ldb
, NULL
, LDB_SCOPE_SUBTREE
, expr
, NULL
, &res
);
250 talloc_steal(expr
, res
);
251 if (ret
!= LDB_SUCCESS
|| res
->count
!= 1) goto failed
;
253 if (!msg_to_group_map(res
->msgs
[0], map
)) goto failed
;
264 Return the sid and the type of the unix group.
266 BOOL
get_group_map_from_ntname(const char *name
, GROUP_MAP
*map
)
270 struct ldb_result
*res
=NULL
;
272 if (!init_group_mapping()) {
276 expr
= talloc_asprintf(ldb
, "(&(ntName=%s)(objectClass=groupMap))", name
);
277 if (expr
== NULL
) goto failed
;
279 ret
= ldb_search(ldb
, NULL
, LDB_SCOPE_SUBTREE
, expr
, NULL
, &res
);
280 talloc_steal(expr
, res
);
281 if (ret
!= LDB_SUCCESS
|| res
->count
!= 1) goto failed
;
283 if (!msg_to_group_map(res
->msgs
[0], map
)) goto failed
;
294 Remove a group mapping entry.
296 BOOL
group_map_remove(const DOM_SID
*sid
)
301 if (!init_group_mapping()) {
305 dn
= mapping_dn(ldb
, sid
);
306 ret
= ldb_delete(ldb
, dn
);
309 return ret
== LDB_SUCCESS
;
314 Enumerate the group mappings for a domain
316 BOOL
enum_group_mapping(const DOM_SID
*domsid
, enum lsa_SidType sid_name_use
,
318 size_t *p_num_entries
, BOOL unix_only
)
323 struct ldb_result
*res
;
324 struct ldb_dn
*basedn
=NULL
;
327 if (!init_group_mapping()) {
331 tmp_ctx
= talloc_new(ldb
);
332 if (tmp_ctx
== NULL
) goto failed
;
334 if (sid_name_use
== SID_NAME_UNKNOWN
) {
335 expr
= talloc_asprintf(tmp_ctx
, "(&(objectClass=groupMap))");
337 expr
= talloc_asprintf(tmp_ctx
, "(&(sidNameUse=%u)(objectClass=groupMap))",
340 if (expr
== NULL
) goto failed
;
342 /* we do a subtree search on the domain */
343 if (domsid
!= NULL
) {
344 sid_to_string(name
, domsid
);
345 basedn
= ldb_dn_string_compose(tmp_ctx
, NULL
, "domain=%s", name
);
346 if (basedn
== NULL
) goto failed
;
349 ret
= ldb_search(ldb
, basedn
, LDB_SCOPE_SUBTREE
, expr
, NULL
, &res
);
350 if (ret
!= LDB_SUCCESS
) goto failed
;
355 for (i
=0;i
<res
->count
;i
++) {
356 (*pp_rmap
) = SMB_REALLOC_ARRAY((*pp_rmap
), GROUP_MAP
,
358 if (!(*pp_rmap
)) goto failed
;
360 if (!msg_to_group_map(res
->msgs
[i
], &(*pp_rmap
)[*p_num_entries
])) {
367 talloc_free(tmp_ctx
);
371 talloc_free(tmp_ctx
);
376 This operation happens on session setup, so it should better be fast. We
377 store a list of aliases a SID is member of hanging off MEMBEROF/SID.
379 NTSTATUS
one_alias_membership(const DOM_SID
*member
,
380 DOM_SID
**sids
, size_t *num
)
382 const char *attrs
[] = {
389 struct ldb_result
*res
=NULL
;
391 NTSTATUS status
= NT_STATUS_INTERNAL_DB_CORRUPTION
;
393 if (!init_group_mapping()) {
394 return NT_STATUS_ACCESS_DENIED
;
397 if (!sid_to_string(string_sid
, member
)) {
398 return NT_STATUS_INVALID_PARAMETER
;
401 expr
= talloc_asprintf(ldb
, "(&(memberOf=%s)(objectClass=groupMap))",
403 if (expr
== NULL
) goto failed
;
405 ret
= ldb_search(ldb
, NULL
, LDB_SCOPE_SUBTREE
, expr
, attrs
, &res
);
406 talloc_steal(expr
, res
);
407 if (ret
!= LDB_SUCCESS
) {
411 for (i
=0;i
<res
->count
;i
++) {
412 struct ldb_message_element
*el
;
413 el
= ldb_msg_find_element(res
->msgs
[i
], "sid");
414 if (el
== NULL
|| el
->num_values
!= 1) {
415 status
= NT_STATUS_INTERNAL_DB_CORRUPTION
;
418 string_to_sid(&alias
, (char *)el
->values
[0].data
);
419 add_sid_to_array_unique(NULL
, &alias
, sids
, num
);
421 status
= NT_STATUS_NO_MEMORY
;
435 add/remove a memberOf field
437 static NTSTATUS
modify_aliasmem(const DOM_SID
*alias
, const DOM_SID
*member
,
442 struct ldb_message msg
;
443 struct ldb_message_element el
;
448 if (!init_group_mapping()) {
449 return NT_STATUS_ACCESS_DENIED
;
452 if (!get_group_map_from_sid(*alias
, &map
)) {
453 sid_to_string(string_sid
, alias
);
454 return NT_STATUS_NO_SUCH_ALIAS
;
457 if ((map
.sid_name_use
!= SID_NAME_ALIAS
) &&
458 (map
.sid_name_use
!= SID_NAME_WKN_GRP
)) {
459 DEBUG(0,("sid_name_use=%d\n", map
.sid_name_use
));
460 return NT_STATUS_NO_SUCH_ALIAS
;
463 tmp_ctx
= talloc_new(NULL
);
464 if (tmp_ctx
== NULL
) {
465 return NT_STATUS_NO_MEMORY
;
468 msg
.dn
= mapping_dn(tmp_ctx
, alias
);
469 msg
.num_elements
= 1;
471 el
.flags
= operation
;
472 el
.name
= talloc_strdup(tmp_ctx
, "memberOf");
475 sid_to_string(string_sid
, member
);
476 val
.data
= (uint8_t *)string_sid
;
477 val
.length
= strlen(string_sid
);
479 ret
= ldb_modify(ldb
, &msg
);
480 talloc_free(tmp_ctx
);
482 if (ret
== LDB_ERR_NO_SUCH_OBJECT
) {
483 return NT_STATUS_NO_SUCH_ALIAS
;
486 if (operation
== LDB_FLAG_MOD_ADD
&&
487 ret
== LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS
) {
488 return NT_STATUS_MEMBER_IN_ALIAS
;
491 return (ret
== LDB_SUCCESS
? NT_STATUS_OK
: NT_STATUS_ACCESS_DENIED
);
494 NTSTATUS
add_aliasmem(const DOM_SID
*alias
, const DOM_SID
*member
)
496 return modify_aliasmem(alias
, member
, LDB_FLAG_MOD_ADD
);
499 NTSTATUS
del_aliasmem(const DOM_SID
*alias
, const DOM_SID
*member
)
501 return modify_aliasmem(alias
, member
, LDB_FLAG_MOD_DELETE
);
506 enumerate sids that have the given alias set in memberOf
508 NTSTATUS
enum_aliasmem(const DOM_SID
*alias
, DOM_SID
**sids
, size_t *num
)
510 const char *attrs
[] = {
515 struct ldb_result
*res
=NULL
;
517 struct ldb_message_element
*el
;
519 if (!init_group_mapping()) {
520 return NT_STATUS_ACCESS_DENIED
;
526 dn
= mapping_dn(ldb
, alias
);
528 ret
= ldb_search(ldb
, dn
, LDB_SCOPE_BASE
, NULL
, attrs
, &res
);
529 talloc_steal(dn
, res
);
530 if (ret
== LDB_SUCCESS
&& res
->count
== 0) {
534 if (ret
!= LDB_SUCCESS
) {
536 return NT_STATUS_INTERNAL_DB_CORRUPTION
;
539 el
= ldb_msg_find_element(res
->msgs
[0], "memberOf");
542 return NT_STATUS_INTERNAL_DB_CORRUPTION
;
545 for (i
=0;i
<el
->num_values
;i
++) {
547 string_to_sid(&sid
, (const char *)el
->values
[i
].data
);
548 add_sid_to_array_unique(NULL
, &sid
, sids
, num
);
551 return NT_STATUS_NO_MEMORY
;
560 upgrade one group mapping record from the old tdb format
562 static int upgrade_map_record(TDB_CONTEXT
*tdb_ctx
, TDB_DATA key
,
563 TDB_DATA data
, void *state
)
568 if (strncmp(key
.dptr
, GROUP_PREFIX
,
569 MIN(key
.dsize
, strlen(GROUP_PREFIX
))) != 0) {
573 if (!string_to_sid(&map
.sid
, strlen(GROUP_PREFIX
) + (const char *)key
.dptr
)) {
574 DEBUG(0,("Bad sid key '%s' during upgrade\n", (const char *)key
.dptr
));
579 ret
= tdb_unpack(data
.dptr
, data
.dsize
, "ddff",
580 &map
.gid
, &map
.sid_name_use
, &map
.nt_name
, &map
.comment
);
582 DEBUG(0,("Failed to unpack group map record during upgrade\n"));
587 if (!add_mapping_entry(&map
, 0)) {
588 DEBUG(0,("Failed to add mapping entry during upgrade\n"));
597 upgrade one alias record from the old tdb format
599 static int upgrade_alias_record(TDB_CONTEXT
*tdb_ctx
, TDB_DATA key
,
600 TDB_DATA data
, void *state
)
602 const char *p
= data
.dptr
;
606 if (strncmp(key
.dptr
, MEMBEROF_PREFIX
,
607 MIN(key
.dsize
, strlen(MEMBEROF_PREFIX
))) != 0) {
611 if (!string_to_sid(&member
, strlen(MEMBEROF_PREFIX
) + (const char *)key
.dptr
)) {
612 DEBUG(0,("Bad alias key %s during upgrade\n",
613 (const char *)key
.dptr
));
617 while (next_token(&p
, string_sid
, " ", sizeof(string_sid
))) {
620 string_to_sid(&alias
, string_sid
);
621 status
= add_aliasmem(&alias
, &member
);
622 if (NT_STATUS_EQUAL(status
, NT_STATUS_NO_SUCH_ALIAS
)) {
623 DEBUG(0,("Ignoring orphaned alias record '%s'\n",
625 } else if (!NT_STATUS_IS_OK(status
)) {
626 DEBUG(0,("Failed to add alias member during upgrade - %s\n",
637 upgrade from a old style tdb
639 static BOOL
mapping_upgrade(const char *tdb_path
)
641 static TDB_CONTEXT
*tdb
;
646 tdb
= tdb_open_log(tdb_path
, 0, TDB_DEFAULT
, O_RDWR
, 0600);
647 if (tdb
== NULL
) goto failed
;
649 /* we have to do the map records first, as alias records may
651 ret
= tdb_traverse(tdb
, upgrade_map_record
, &status
);
652 if (ret
== -1 || status
== -1) goto failed
;
654 ret
= tdb_traverse(tdb
, upgrade_alias_record
, &status
);
655 if (ret
== -1 || status
== -1) goto failed
;
657 if (tdb
) tdb_close(tdb
);
659 pstrcpy(old_path
, tdb_path
);
660 pstrcpy(new_path
, lock_path("group_mapping.tdb.upgraded"));
662 if (rename(old_path
, new_path
) != 0) {
663 DEBUG(0,("Failed to rename old group mapping database\n"));
669 DEBUG(0,("Failed to upgrade group mapping database\n"));
670 if (tdb
) tdb_close(tdb
);