2 Unix SMB/CIFS implementation.
4 Copyright (C) Tim Potter 2000
5 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
6 Copyright (C) Simo Sorce 2003-2007
7 Copyright (C) Jeremy Allison 2006
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 #define DBGC_CLASS DBGC_IDMAP
31 struct idmap_backend
{
33 struct idmap_methods
*methods
;
34 struct idmap_backend
*prev
, *next
;
37 struct idmap_alloc_backend
{
39 struct idmap_alloc_methods
*methods
;
40 struct idmap_alloc_backend
*prev
, *next
;
43 struct idmap_cache_ctx
;
45 struct idmap_alloc_context
{
47 struct idmap_alloc_methods
*methods
;
51 static TALLOC_CTX
*idmap_ctx
= NULL
;
52 static struct idmap_cache_ctx
*idmap_cache
;
54 static struct idmap_backend
*backends
= NULL
;
55 static struct idmap_domain
**idmap_domains
= NULL
;
56 static int num_domains
= 0;
57 static int pdb_dom_num
= -1;
58 static int def_dom_num
= -1;
60 static struct idmap_alloc_backend
*alloc_backends
= NULL
;
61 static struct idmap_alloc_context
*idmap_alloc_ctx
= NULL
;
63 #define IDMAP_CHECK_RET(ret) do { \
64 if ( ! NT_STATUS_IS_OK(ret)) { \
65 DEBUG(2, ("ERROR: NTSTATUS = 0x%08x\n", NT_STATUS_V(ret))); \
68 #define IDMAP_REPORT_RET(ret) do { \
69 if ( ! NT_STATUS_IS_OK(ret)) { \
70 DEBUG(2, ("ERROR: NTSTATUS = 0x%08x\n", NT_STATUS_V(ret))); \
72 #define IDMAP_CHECK_ALLOC(mem) do { \
74 DEBUG(0, ("Out of memory!\n")); ret = NT_STATUS_NO_MEMORY; \
78 static struct idmap_methods
*get_methods(struct idmap_backend
*be
,
81 struct idmap_backend
*b
;
83 for (b
= be
; b
; b
= b
->next
) {
84 if (strequal(b
->name
, name
)) {
92 static struct idmap_alloc_methods
*get_alloc_methods(
93 struct idmap_alloc_backend
*be
,
96 struct idmap_alloc_backend
*b
;
98 for (b
= be
; b
; b
= b
->next
) {
99 if (strequal(b
->name
, name
)) {
107 bool idmap_is_offline(void)
109 return ( lp_winbind_offline_logon() &&
110 get_global_winbindd_state_offline() );
113 /**********************************************************************
114 Allow a module to register itself as a method.
115 **********************************************************************/
117 NTSTATUS
smb_register_idmap(int version
, const char *name
,
118 struct idmap_methods
*methods
)
120 struct idmap_methods
*test
;
121 struct idmap_backend
*entry
;
124 return NT_STATUS_INTERNAL_DB_ERROR
;
127 if ((version
!= SMB_IDMAP_INTERFACE_VERSION
)) {
128 DEBUG(0, ("Failed to register idmap module.\n"
129 "The module was compiled against "
130 "SMB_IDMAP_INTERFACE_VERSION %d,\n"
131 "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
132 "Please recompile against the current version "
134 version
, SMB_IDMAP_INTERFACE_VERSION
));
135 return NT_STATUS_OBJECT_TYPE_MISMATCH
;
138 if (!name
|| !name
[0] || !methods
) {
139 DEBUG(0,("Called with NULL pointer or empty name!\n"));
140 return NT_STATUS_INVALID_PARAMETER
;
143 test
= get_methods(backends
, name
);
145 DEBUG(0,("Idmap module %s already registered!\n", name
));
146 return NT_STATUS_OBJECT_NAME_COLLISION
;
149 entry
= talloc(idmap_ctx
, struct idmap_backend
);
151 DEBUG(0,("Out of memory!\n"));
152 return NT_STATUS_NO_MEMORY
;
154 entry
->name
= talloc_strdup(idmap_ctx
, name
);
155 if ( ! entry
->name
) {
156 DEBUG(0,("Out of memory!\n"));
157 return NT_STATUS_NO_MEMORY
;
159 entry
->methods
= methods
;
161 DLIST_ADD(backends
, entry
);
162 DEBUG(5, ("Successfully added idmap backend '%s'\n", name
));
166 /**********************************************************************
167 Allow a module to register itself as a method.
168 **********************************************************************/
170 NTSTATUS
smb_register_idmap_alloc(int version
, const char *name
,
171 struct idmap_alloc_methods
*methods
)
173 struct idmap_alloc_methods
*test
;
174 struct idmap_alloc_backend
*entry
;
177 return NT_STATUS_INTERNAL_DB_ERROR
;
180 if ((version
!= SMB_IDMAP_INTERFACE_VERSION
)) {
181 DEBUG(0, ("Failed to register idmap alloc module.\n"
182 "The module was compiled against "
183 "SMB_IDMAP_INTERFACE_VERSION %d,\n"
184 "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
185 "Please recompile against the current version "
187 version
, SMB_IDMAP_INTERFACE_VERSION
));
188 return NT_STATUS_OBJECT_TYPE_MISMATCH
;
191 if (!name
|| !name
[0] || !methods
) {
192 DEBUG(0,("Called with NULL pointer or empty name!\n"));
193 return NT_STATUS_INVALID_PARAMETER
;
196 test
= get_alloc_methods(alloc_backends
, name
);
198 DEBUG(0,("idmap_alloc module %s already registered!\n", name
));
199 return NT_STATUS_OBJECT_NAME_COLLISION
;
202 entry
= talloc(idmap_ctx
, struct idmap_alloc_backend
);
204 DEBUG(0,("Out of memory!\n"));
205 return NT_STATUS_NO_MEMORY
;
207 entry
->name
= talloc_strdup(idmap_ctx
, name
);
208 if ( ! entry
->name
) {
209 DEBUG(0,("Out of memory!\n"));
210 return NT_STATUS_NO_MEMORY
;
212 entry
->methods
= methods
;
214 DLIST_ADD(alloc_backends
, entry
);
215 DEBUG(5, ("Successfully added idmap alloc backend '%s'\n", name
));
219 static int close_domain_destructor(struct idmap_domain
*dom
)
223 ret
= dom
->methods
->close_fn(dom
);
224 if (!NT_STATUS_IS_OK(ret
)) {
225 DEBUG(3, ("Failed to close idmap domain [%s]!\n", dom
->name
));
231 /**************************************************************************
233 **************************************************************************/
235 NTSTATUS
idmap_close(void)
237 /* close the alloc backend first before freeing idmap_ctx */
238 if (idmap_alloc_ctx
) {
239 idmap_alloc_ctx
->methods
->close_fn();
240 idmap_alloc_ctx
->methods
= NULL
;
242 alloc_backends
= NULL
;
244 /* this talloc_free call will fire the talloc destructors
245 * that will free all active backends resources */
246 TALLOC_FREE(idmap_ctx
);
248 idmap_domains
= NULL
;
254 /****************************************************************************
255 ****************************************************************************/
257 NTSTATUS
idmap_init_cache(void)
259 /* Always initialize the cache. We'll have to delay initialization
260 of backends if we are offline */
266 if ( (idmap_ctx
= talloc_named_const(NULL
, 0, "idmap_ctx")) == NULL
) {
267 return NT_STATUS_NO_MEMORY
;
270 if ( (idmap_cache
= idmap_cache_init(idmap_ctx
)) == NULL
) {
271 return NT_STATUS_UNSUCCESSFUL
;
277 /****************************************************************************
278 ****************************************************************************/
280 NTSTATUS
idmap_init(void)
283 static NTSTATUS idmap_init_status
= NT_STATUS_UNSUCCESSFUL
;
284 struct idmap_domain
*dom
;
285 char *compat_backend
= NULL
;
286 char *compat_params
= NULL
;
287 const char **dom_list
= NULL
;
288 const char *default_domain
= NULL
;
289 char *alloc_backend
= NULL
;
290 bool default_already_defined
= False
;
291 bool pri_dom_is_in_list
= False
;
295 ret
= idmap_init_cache();
296 if (!NT_STATUS_IS_OK(ret
))
299 if (NT_STATUS_IS_OK(idmap_init_status
)) {
303 /* We can't reliably call intialization code here unless
304 we are online. But return NT_STATUS_OK so the upper
305 level code doesn't abort idmap lookups. */
307 if ( get_global_winbindd_state_offline() ) {
308 idmap_init_status
= NT_STATUS_FILE_IS_OFFLINE
;
314 dom_list
= lp_idmap_domains();
316 if ( lp_idmap_backend() ) {
317 const char **compat_list
= lp_idmap_backend();
319 const char *q
= NULL
;
322 DEBUG(0, ("WARNING: idmap backend and idmap domains are"
323 " mutually exclusive!\n"));
324 DEBUGADD(0,("idmap backend option will be IGNORED!\n"));
328 compat_backend
= talloc_strdup(idmap_ctx
, *compat_list
);
330 /* strip any leading idmap_ prefix of */
331 if (strncmp(*compat_list
, "idmap_", 6) == 0 ) {
332 q
= *compat_list
+= 6;
333 DEBUG(0, ("WARNING: idmap backend uses obsolete"
334 " and deprecated 'idmap_' prefix.\n"
335 "Please replace 'idmap_%s' by '%s' in"
336 " %s\n", q
, q
, get_dyn_CONFIGFILE()));
337 compat_backend
= talloc_strdup(idmap_ctx
, q
);
339 compat_backend
= talloc_strdup(idmap_ctx
,
343 if (compat_backend
== NULL
) {
344 ret
= NT_STATUS_NO_MEMORY
;
348 /* separate the backend and module arguements */
349 if ((p
= strchr(compat_backend
, ':')) != NULL
) {
351 compat_params
= p
+ 1;
354 } else if ( !dom_list
) {
355 /* Back compatible: without idmap domains and explicit
356 idmap backend. Taking default idmap backend: tdb */
359 compat_backend
= talloc_strdup( idmap_ctx
, "tdb");
360 compat_params
= compat_backend
;
364 /* generate a list with our main domain */
367 dl
= talloc_array(idmap_ctx
, const char *, 2);
369 ret
= NT_STATUS_NO_MEMORY
;
372 dl
[0] = talloc_strdup(dl
, lp_workgroup());
374 ret
= NT_STATUS_NO_MEMORY
;
382 default_domain
= dl
[0];
385 /***************************
386 * initialize idmap domains
388 DEBUG(1, ("Initializing idmap domains\n"));
390 for (i
=0, num_domains
=0; dom_list
[i
]; i
++) {
391 const char *parm_backend
;
394 /* ignore BUILTIN and local MACHINE domains */
395 if (strequal(dom_list
[i
], "BUILTIN")
396 || strequal(dom_list
[i
], get_global_sam_name()))
398 DEBUG(0,("idmap_init: Ignoring domain %s\n",
403 if ((dom_list
[i
] != default_domain
) &&
404 strequal(dom_list
[i
], lp_workgroup())) {
405 pri_dom_is_in_list
= True
;
409 dom
= TALLOC_ZERO_P(idmap_ctx
, struct idmap_domain
);
410 IDMAP_CHECK_ALLOC(dom
);
412 dom
->name
= talloc_strdup(dom
, dom_list
[i
]);
413 IDMAP_CHECK_ALLOC(dom
->name
);
415 config_option
= talloc_asprintf(dom
, "idmap config %s",
417 IDMAP_CHECK_ALLOC(config_option
);
419 /* default or specific ? */
421 dom
->default_domain
= lp_parm_bool(-1, config_option
,
424 if (dom
->default_domain
||
425 (default_domain
&& strequal(dom_list
[i
], default_domain
))) {
427 /* make sure this is set even when we match
429 dom
->default_domain
= True
;
431 if (default_already_defined
) {
432 DEBUG(1, ("ERROR: Multiple domains defined as"
434 ret
= NT_STATUS_INVALID_PARAMETER
;
438 default_already_defined
= True
;
442 dom
->readonly
= lp_parm_bool(-1, config_option
,
445 /* find associated backend (default: tdb) */
447 parm_backend
= talloc_strdup(idmap_ctx
, compat_backend
);
449 parm_backend
= talloc_strdup(idmap_ctx
,
450 lp_parm_const_string(
454 IDMAP_CHECK_ALLOC(parm_backend
);
456 /* get the backend methods for this domain */
457 dom
->methods
= get_methods(backends
, parm_backend
);
459 if ( ! dom
->methods
) {
460 ret
= smb_probe_module("idmap", parm_backend
);
461 if (NT_STATUS_IS_OK(ret
)) {
462 dom
->methods
= get_methods(backends
,
466 if ( ! dom
->methods
) {
467 DEBUG(0, ("ERROR: Could not get methods for "
468 "backend %s\n", parm_backend
));
469 ret
= NT_STATUS_UNSUCCESSFUL
;
473 /* check the set_mapping function exists otherwise mark the
474 * module as readonly */
475 if ( ! dom
->methods
->set_mapping
) {
476 DEBUG(5, ("Forcing to readonly, as this module can't"
477 " store arbitrary mappings.\n"));
478 dom
->readonly
= True
;
481 /* now that we have methods,
482 * set the destructor for this domain */
483 talloc_set_destructor(dom
, close_domain_destructor
);
486 dom
->params
= talloc_strdup(dom
, compat_params
);
487 IDMAP_CHECK_ALLOC(dom
->params
);
492 /* Finally instance a backend copy for this domain */
493 ret
= dom
->methods
->init(dom
);
494 if ( ! NT_STATUS_IS_OK(ret
)) {
495 DEBUG(0, ("ERROR: Initialization failed for backend "
496 "%s (domain %s), deferred!\n",
497 parm_backend
, dom
->name
));
499 idmap_domains
= talloc_realloc(idmap_ctx
, idmap_domains
,
500 struct idmap_domain
*, i
+1);
501 if ( ! idmap_domains
) {
502 DEBUG(0, ("Out of memory!\n"));
503 ret
= NT_STATUS_NO_MEMORY
;
506 idmap_domains
[num_domains
] = dom
;
508 /* save default domain position for future uses */
509 if (dom
->default_domain
) {
510 def_dom_num
= num_domains
;
513 /* Bump counter to next available slot */
517 DEBUG(10, ("Domain %s - Backend %s - %sdefault - %sreadonly\n",
518 dom
->name
, parm_backend
,
519 dom
->default_domain
?"":"not ",
520 dom
->readonly
?"":"not "));
522 talloc_free(config_option
);
525 /* on DCs we need to add idmap_tdb as the default backend if compat is
526 * defined (when the old implicit configuration is used)
527 * This is not done in the previous loop a on member server we exclude
528 * the local domain. But on a DC the local domain is the only domain
529 * available therefore we are left with no default domain */
530 if (((lp_server_role() == ROLE_DOMAIN_PDC
) ||
531 (lp_server_role() == ROLE_DOMAIN_BDC
)) &&
532 ((num_domains
== 0) && (compat
== 1))) {
534 dom
= TALLOC_ZERO_P(idmap_ctx
, struct idmap_domain
);
535 IDMAP_CHECK_ALLOC(dom
);
537 dom
->name
= talloc_strdup(dom
, "__default__");
538 IDMAP_CHECK_ALLOC(dom
->name
);
540 dom
->default_domain
= True
;
541 dom
->readonly
= False
;
543 /* get the backend methods for this domain */
544 dom
->methods
= get_methods(backends
, compat_backend
);
546 if ( ! dom
->methods
) {
547 ret
= smb_probe_module("idmap", compat_backend
);
548 if (NT_STATUS_IS_OK(ret
)) {
549 dom
->methods
= get_methods(backends
,
553 if ( ! dom
->methods
) {
554 DEBUG(0, ("ERROR: Could not get methods for "
555 "backend %s\n", compat_backend
));
556 ret
= NT_STATUS_UNSUCCESSFUL
;
560 /* now that we have methods,
561 * set the destructor for this domain */
562 talloc_set_destructor(dom
, close_domain_destructor
);
564 dom
->params
= talloc_strdup(dom
, compat_params
);
565 IDMAP_CHECK_ALLOC(dom
->params
);
567 /* Finally instance a backend copy for this domain */
568 ret
= dom
->methods
->init(dom
);
569 if ( ! NT_STATUS_IS_OK(ret
)) {
570 DEBUG(0, ("ERROR: Initialization failed for backend "
571 "%s (domain %s), deferred!\n",
572 compat_backend
, dom
->name
));
574 idmap_domains
= talloc_realloc(idmap_ctx
, idmap_domains
,
575 struct idmap_domain
*, 2);
576 if ( ! idmap_domains
) {
577 DEBUG(0, ("Out of memory!\n"));
578 ret
= NT_STATUS_NO_MEMORY
;
581 idmap_domains
[num_domains
] = dom
;
583 def_dom_num
= num_domains
;
585 /* Bump counter to next available slot */
589 DEBUG(10, ("Domain %s - Backend %s - %sdefault - %sreadonly\n",
590 dom
->name
, compat_backend
,
591 dom
->default_domain
?"":"not ",
592 dom
->readonly
?"":"not "));
595 /* automatically add idmap_nss backend if needed */
596 if ((lp_server_role() == ROLE_DOMAIN_MEMBER
) &&
597 ( ! pri_dom_is_in_list
) &&
598 lp_winbind_trusted_domains_only()) {
600 dom
= TALLOC_ZERO_P(idmap_ctx
, struct idmap_domain
);
601 IDMAP_CHECK_ALLOC(dom
);
603 dom
->name
= talloc_strdup(dom
, lp_workgroup());
604 IDMAP_CHECK_ALLOC(dom
->name
);
606 dom
->default_domain
= False
;
607 dom
->readonly
= True
;
609 /* get the backend methods for passdb */
610 dom
->methods
= get_methods(backends
, "nss");
612 /* (the nss module is always statically linked) */
613 if ( ! dom
->methods
) {
614 DEBUG(0, ("ERROR: No methods for idmap_nss ?!\n"));
615 ret
= NT_STATUS_UNSUCCESSFUL
;
619 /* now that we have methods,
620 * set the destructor for this domain */
621 talloc_set_destructor(dom
, close_domain_destructor
);
624 dom
->params
= talloc_strdup(dom
, compat_params
);
625 IDMAP_CHECK_ALLOC(dom
->params
);
630 /* Finally instance a backend copy for this domain */
631 ret
= dom
->methods
->init(dom
);
632 if ( ! NT_STATUS_IS_OK(ret
)) {
633 DEBUG(0, ("ERROR: Init. failed for idmap_nss ?!\n"));
634 ret
= NT_STATUS_UNSUCCESSFUL
;
638 idmap_domains
= talloc_realloc(idmap_ctx
,
640 struct idmap_domain
*,
642 if ( ! idmap_domains
) {
643 DEBUG(0, ("Out of memory!\n"));
644 ret
= NT_STATUS_NO_MEMORY
;
647 idmap_domains
[num_domains
] = dom
;
649 DEBUG(10, ("Domain %s - Backend nss - not default - readonly\n",
655 /**** automatically add idmap_passdb backend ****/
656 dom
= TALLOC_ZERO_P(idmap_ctx
, struct idmap_domain
);
657 IDMAP_CHECK_ALLOC(dom
);
659 dom
->name
= talloc_strdup(dom
, get_global_sam_name());
660 IDMAP_CHECK_ALLOC(dom
->name
);
662 dom
->default_domain
= False
;
663 dom
->readonly
= True
;
665 /* get the backend methods for passdb */
666 dom
->methods
= get_methods(backends
, "passdb");
668 /* (the passdb module is always statically linked) */
669 if ( ! dom
->methods
) {
670 DEBUG(0, ("ERROR: No methods for idmap_passdb ?!\n"));
671 ret
= NT_STATUS_UNSUCCESSFUL
;
675 /* now that we have methods, set the destructor for this domain */
676 talloc_set_destructor(dom
, close_domain_destructor
);
679 dom
->params
= talloc_strdup(dom
, compat_params
);
680 IDMAP_CHECK_ALLOC(dom
->params
);
685 /* Finally instance a backend copy for this domain */
686 ret
= dom
->methods
->init(dom
);
687 if ( ! NT_STATUS_IS_OK(ret
)) {
688 DEBUG(0, ("ERROR: Init. failed for idmap_passdb ?!\n"));
689 ret
= NT_STATUS_UNSUCCESSFUL
;
693 idmap_domains
= talloc_realloc(idmap_ctx
,
695 struct idmap_domain
*,
697 if ( ! idmap_domains
) {
698 DEBUG(0, ("Out of memory!\n"));
699 ret
= NT_STATUS_NO_MEMORY
;
702 idmap_domains
[num_domains
] = dom
;
704 /* needed to handle special BUILTIN and wellknown SIDs cases */
705 pdb_dom_num
= num_domains
;
707 DEBUG(10, ("Domain %s - Backend passdb - not default - readonly\n",
711 /**** finished adding idmap_passdb backend ****/
713 /* sort domains so that the default is the last one */
714 /* don't sort if no default domain defined */
715 if (def_dom_num
!= -1 && def_dom_num
!= num_domains
-1) {
716 /* default is not last, move it */
717 struct idmap_domain
*tmp
;
719 if (pdb_dom_num
> def_dom_num
) {
722 } else if (pdb_dom_num
== def_dom_num
) { /* ?? */
723 pdb_dom_num
= num_domains
- 1;
726 tmp
= idmap_domains
[def_dom_num
];
728 for (i
= def_dom_num
; i
< num_domains
-1; i
++) {
729 idmap_domains
[i
] = idmap_domains
[i
+1];
731 idmap_domains
[i
] = tmp
;
736 /* Initialize alloc module */
738 DEBUG(3, ("Initializing idmap alloc module\n"));
740 alloc_backend
= NULL
;
742 alloc_backend
= talloc_strdup(idmap_ctx
, compat_backend
);
744 char *ab
= lp_idmap_alloc_backend();
746 if (ab
&& (ab
[0] != '\0')) {
747 alloc_backend
= talloc_strdup(idmap_ctx
,
748 lp_idmap_alloc_backend());
752 if ( alloc_backend
) {
754 idmap_alloc_ctx
= TALLOC_ZERO_P(idmap_ctx
,
755 struct idmap_alloc_context
);
756 IDMAP_CHECK_ALLOC(idmap_alloc_ctx
);
758 idmap_alloc_ctx
->methods
= get_alloc_methods(alloc_backends
,
760 if ( ! idmap_alloc_ctx
->methods
) {
761 ret
= smb_probe_module("idmap", alloc_backend
);
762 if (NT_STATUS_IS_OK(ret
)) {
763 idmap_alloc_ctx
->methods
=
764 get_alloc_methods(alloc_backends
,
768 if (idmap_alloc_ctx
->methods
) {
771 idmap_alloc_ctx
->params
=
772 talloc_strdup(idmap_alloc_ctx
,
774 IDMAP_CHECK_ALLOC(idmap_alloc_ctx
->params
);
776 idmap_alloc_ctx
->params
= NULL
;
779 ret
= idmap_alloc_ctx
->methods
->init(idmap_alloc_ctx
->params
);
780 if ( ! NT_STATUS_IS_OK(ret
)) {
781 DEBUG(0, ("ERROR: Initialization failed for "
782 "alloc backend %s, deferred!\n",
785 idmap_alloc_ctx
->initialized
= True
;
788 DEBUG(2, ("idmap_init: Unable to get methods for "
789 "alloc backend %s\n",
791 /* certain compat backends are just readonly */
793 TALLOC_FREE(idmap_alloc_ctx
);
796 ret
= NT_STATUS_UNSUCCESSFUL
;
801 /* cleanpu temporary strings */
802 TALLOC_FREE( compat_backend
);
804 idmap_init_status
= NT_STATUS_OK
;
809 DEBUG(0, ("Aborting IDMAP Initialization ...\n"));
815 static NTSTATUS
idmap_alloc_init(void)
819 if (! NT_STATUS_IS_OK(ret
= idmap_init())) {
823 if ( ! idmap_alloc_ctx
) {
824 return NT_STATUS_NOT_SUPPORTED
;
827 if ( ! idmap_alloc_ctx
->initialized
) {
828 ret
= idmap_alloc_ctx
->methods
->init(idmap_alloc_ctx
->params
);
829 if ( ! NT_STATUS_IS_OK(ret
)) {
830 DEBUG(0, ("ERROR: Initialization failed for alloc "
831 "backend, deferred!\n"));
834 idmap_alloc_ctx
->initialized
= True
;
841 /**************************************************************************
842 idmap allocator interface functions
843 **************************************************************************/
845 NTSTATUS
idmap_allocate_uid(struct unixid
*id
)
849 if (! NT_STATUS_IS_OK(ret
= idmap_alloc_init())) {
853 id
->type
= ID_TYPE_UID
;
854 return idmap_alloc_ctx
->methods
->allocate_id(id
);
857 NTSTATUS
idmap_allocate_gid(struct unixid
*id
)
861 if (! NT_STATUS_IS_OK(ret
= idmap_alloc_init())) {
865 id
->type
= ID_TYPE_GID
;
866 return idmap_alloc_ctx
->methods
->allocate_id(id
);
869 NTSTATUS
idmap_set_uid_hwm(struct unixid
*id
)
873 if (! NT_STATUS_IS_OK(ret
= idmap_alloc_init())) {
877 id
->type
= ID_TYPE_UID
;
878 return idmap_alloc_ctx
->methods
->set_id_hwm(id
);
881 NTSTATUS
idmap_set_gid_hwm(struct unixid
*id
)
885 if (! NT_STATUS_IS_OK(ret
= idmap_alloc_init())) {
889 id
->type
= ID_TYPE_GID
;
890 return idmap_alloc_ctx
->methods
->set_id_hwm(id
);
893 /******************************************************************************
894 Lookup an idmap_domain give a full user or group SID
895 ******************************************************************************/
897 static struct idmap_domain
* find_idmap_domain_from_sid( DOM_SID
*account_sid
)
901 struct winbindd_domain
*domain
= NULL
;
904 /* 1. Handle BUILTIN or Special SIDs and prevent them from
905 falling into the default domain space (if we have a
906 configured passdb backend. */
908 if ( (pdb_dom_num
!= -1) &&
909 (sid_check_is_in_builtin(account_sid
) ||
910 sid_check_is_in_wellknown_domain(account_sid
) ||
911 sid_check_is_in_unix_groups(account_sid
) ||
912 sid_check_is_in_unix_users(account_sid
)) )
914 return idmap_domains
[pdb_dom_num
];
917 /* 2. Lookup the winbindd_domain from the account_sid */
919 sid_copy( &domain_sid
, account_sid
);
920 sid_split_rid( &domain_sid
, &rid
);
921 domain
= find_domain_from_sid_noinit( &domain_sid
);
923 for (i
= 0; domain
&& i
< num_domains
; i
++) {
924 if ( strequal( idmap_domains
[i
]->name
, domain
->name
) ) {
925 return idmap_domains
[i
];
929 /* 3. Fall back to the default domain */
931 if ( def_dom_num
!= -1 ) {
932 return idmap_domains
[def_dom_num
];
938 /******************************************************************************
939 Lookup an index given an idmap_domain pointer
940 ******************************************************************************/
942 static uint32
find_idmap_domain_index( struct idmap_domain
*id_domain
)
946 for (i
= 0; i
< num_domains
; i
++) {
947 if ( idmap_domains
[i
] == id_domain
)
955 /*********************************************************
956 Check if creating a mapping is permitted for the domain
957 *********************************************************/
959 static NTSTATUS
idmap_can_map(const struct id_map
*map
,
960 struct idmap_domain
**ret_dom
)
962 struct idmap_domain
*dom
;
964 /* Check we do not create mappings for our own local domain,
965 * or BUILTIN or special SIDs */
966 if ((sid_compare_domain(map
->sid
, get_global_sam_sid()) == 0) ||
967 sid_check_is_in_builtin(map
->sid
) ||
968 sid_check_is_in_wellknown_domain(map
->sid
) ||
969 sid_check_is_in_unix_users(map
->sid
) ||
970 sid_check_is_in_unix_groups(map
->sid
) )
972 DEBUG(10, ("We are not supposed to create mappings for our own "
973 "domains (local, builtin, specials)\n"));
974 return NT_STATUS_UNSUCCESSFUL
;
977 /* Special check for trusted domain only = Yes */
978 if (lp_winbind_trusted_domains_only()) {
979 struct winbindd_domain
*wdom
= find_our_domain();
980 if (wdom
&& (sid_compare_domain(map
->sid
, &wdom
->sid
) == 0)) {
981 DEBUG(10, ("We are not supposed to create mappings for "
982 "our primary domain when <trusted domain "
984 DEBUGADD(10, ("Leave [%s] unmapped\n",
985 sid_string_dbg(map
->sid
)));
986 return NT_STATUS_UNSUCCESSFUL
;
990 if ( (dom
= find_idmap_domain_from_sid( map
->sid
)) == NULL
) {
991 /* huh, couldn't find a suitable domain,
992 * let's just leave it unmapped */
993 DEBUG(10, ("Could not find idmap backend for SID %s\n",
994 sid_string_dbg(map
->sid
)));
995 return NT_STATUS_NO_SUCH_DOMAIN
;
999 /* ouch the domain is read only,
1000 * let's just leave it unmapped */
1001 DEBUG(10, ("idmap backend for SID %s is READONLY!\n",
1002 sid_string_dbg(map
->sid
)));
1003 return NT_STATUS_UNSUCCESSFUL
;
1007 return NT_STATUS_OK
;
1010 static NTSTATUS
idmap_new_mapping(TALLOC_CTX
*ctx
, struct id_map
*map
)
1013 struct idmap_domain
*dom
;
1015 /* If we are offline we cannot lookup SIDs, deny mapping */
1016 if (idmap_is_offline()) {
1017 return NT_STATUS_FILE_IS_OFFLINE
;
1020 ret
= idmap_can_map(map
, &dom
);
1021 if ( ! NT_STATUS_IS_OK(ret
)) {
1022 return NT_STATUS_NONE_MAPPED
;
1025 /* check if this is a valid SID and then map it */
1026 switch (map
->xid
.type
) {
1028 ret
= idmap_allocate_uid(&map
->xid
);
1029 if ( ! NT_STATUS_IS_OK(ret
)) {
1030 /* can't allocate id, let's just leave it unmapped */
1031 DEBUG(2, ("uid allocation failed! "
1032 "Can't create mapping\n"));
1033 return NT_STATUS_NONE_MAPPED
;
1037 ret
= idmap_allocate_gid(&map
->xid
);
1038 if ( ! NT_STATUS_IS_OK(ret
)) {
1039 /* can't allocate id, let's just leave it unmapped */
1040 DEBUG(2, ("gid allocation failed! "
1041 "Can't create mapping\n"));
1042 return NT_STATUS_NONE_MAPPED
;
1046 /* invalid sid, let's just leave it unmapped */
1047 DEBUG(3,("idmap_new_mapping: Refusing to create a "
1048 "mapping for an unspecified ID type.\n"));
1049 return NT_STATUS_NONE_MAPPED
;
1052 /* ok, got a new id, let's set a mapping */
1053 map
->status
= ID_MAPPED
;
1055 DEBUG(10, ("Setting mapping: %s <-> %s %lu\n",
1056 sid_string_dbg(map
->sid
),
1057 (map
->xid
.type
== ID_TYPE_UID
) ? "UID" : "GID",
1058 (unsigned long)map
->xid
.id
));
1059 ret
= dom
->methods
->set_mapping(dom
, map
);
1061 if ( ! NT_STATUS_IS_OK(ret
)) {
1062 /* something wrong here :-( */
1063 DEBUG(2, ("Failed to commit mapping\n!"));
1065 /* TODO: would it make sense to have an "unalloc_id function?" */
1067 return NT_STATUS_NONE_MAPPED
;
1070 return NT_STATUS_OK
;
1073 static NTSTATUS
idmap_backends_set_mapping(const struct id_map
*map
)
1075 struct idmap_domain
*dom
;
1078 DEBUG(10, ("Setting mapping %s <-> %s %lu\n",
1079 sid_string_dbg(map
->sid
),
1080 (map
->xid
.type
== ID_TYPE_UID
) ? "UID" : "GID",
1081 (unsigned long)map
->xid
.id
));
1083 ret
= idmap_can_map(map
, &dom
);
1084 if ( ! NT_STATUS_IS_OK(ret
)) {
1088 DEBUG(10,("set_mapping for domain %s\n", dom
->name
));
1090 return dom
->methods
->set_mapping(dom
, map
);
1093 static NTSTATUS
idmap_backends_unixids_to_sids(struct id_map
**ids
)
1095 struct idmap_domain
*dom
;
1096 struct id_map
**unmapped
;
1097 struct id_map
**_ids
;
1102 if (!ids
|| !*ids
) {
1103 DEBUG(1, ("Invalid list of maps\n"));
1104 return NT_STATUS_INVALID_PARAMETER
;
1107 ctx
= talloc_named_const(NULL
, 0, "idmap_backends_unixids_to_sids ctx");
1109 DEBUG(0, ("Out of memory!\n"));
1110 return NT_STATUS_NO_MEMORY
;
1113 DEBUG(10, ("Query backends to map ids->sids\n"));
1115 /* start from the default (the last one) and then if there are still
1116 * unmapped entries cycle through the others */
1121 for (n
= num_domains
-1; n
>= 0; n
--) { /* cycle backwards */
1123 dom
= idmap_domains
[n
];
1125 DEBUG(10, ("Query sids from domain %s\n", dom
->name
));
1127 ret
= dom
->methods
->unixids_to_sids(dom
, _ids
);
1128 IDMAP_REPORT_RET(ret
);
1132 for (i
= 0, u
= 0; _ids
[i
]; i
++) {
1133 if (_ids
[i
]->status
!= ID_MAPPED
) {
1134 unmapped
= talloc_realloc(ctx
, unmapped
,
1135 struct id_map
*, u
+ 2);
1136 IDMAP_CHECK_ALLOC(unmapped
);
1137 unmapped
[u
] = _ids
[i
];
1142 /* terminate the unmapped list */
1144 } else { /* no more entries, get out */
1153 /* there are still unmapped ids,
1154 * map them to the unix users/groups domains */
1155 /* except for expired entries,
1156 * these will be returned as valid (offline mode) */
1157 for (i
= 0; unmapped
[i
]; i
++) {
1158 if (unmapped
[i
]->status
== ID_EXPIRED
) continue;
1159 switch (unmapped
[i
]->xid
.type
) {
1161 uid_to_unix_users_sid(
1162 (uid_t
)unmapped
[i
]->xid
.id
,
1164 unmapped
[i
]->status
= ID_MAPPED
;
1167 gid_to_unix_groups_sid(
1168 (gid_t
)unmapped
[i
]->xid
.id
,
1170 unmapped
[i
]->status
= ID_MAPPED
;
1172 default: /* what?! */
1173 unmapped
[i
]->status
= ID_UNKNOWN
;
1186 static NTSTATUS
idmap_backends_sids_to_unixids(struct id_map
**ids
)
1188 struct id_map
***dom_ids
;
1189 struct idmap_domain
*dom
;
1194 if ( (ctx
= talloc_named_const(NULL
, 0, "be_sids_to_ids")) == NULL
) {
1195 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1196 return NT_STATUS_NO_MEMORY
;
1199 DEBUG(10, ("Query backends to map sids->ids\n"));
1201 /* split list per domain */
1202 if (num_domains
== 0) {
1203 DEBUG(1, ("No domains available?\n"));
1204 return NT_STATUS_UNSUCCESSFUL
;
1207 dom_ids
= TALLOC_ZERO_ARRAY(ctx
, struct id_map
**, num_domains
);
1208 IDMAP_CHECK_ALLOC(dom_ids
);
1209 counters
= TALLOC_ZERO_ARRAY(ctx
, int, num_domains
);
1210 IDMAP_CHECK_ALLOC(counters
);
1212 /* partition the requests by domain */
1214 for (i
= 0; ids
[i
]; i
++) {
1217 if ((dom
= find_idmap_domain_from_sid(ids
[i
]->sid
)) == NULL
) {
1218 /* no available idmap_domain. Move on */
1222 DEBUG(10,("SID %s is being handled by %s\n",
1223 sid_string_dbg(ids
[i
]->sid
),
1224 dom
? dom
->name
: "none" ));
1226 idx
= find_idmap_domain_index( dom
);
1227 SMB_ASSERT( idx
!= -1 );
1229 dom_ids
[idx
] = talloc_realloc(ctx
, dom_ids
[idx
],
1232 IDMAP_CHECK_ALLOC(dom_ids
[idx
]);
1234 dom_ids
[idx
][counters
[idx
]] = ids
[i
];
1236 dom_ids
[idx
][counters
[idx
]] = NULL
;
1239 /* All the ids have been dispatched in the right queues.
1240 Let's cycle through the filled ones */
1242 for (i
= 0; i
< num_domains
; i
++) {
1244 dom
= idmap_domains
[i
];
1245 DEBUG(10, ("Query ids from domain %s\n", dom
->name
));
1246 ret
= dom
->methods
->sids_to_unixids(dom
, dom_ids
[i
]);
1247 IDMAP_REPORT_RET(ret
);
1251 /* ok all the backends have been contacted at this point */
1252 /* let's see if we have any unmapped SID left and act accordingly */
1254 for (i
= 0; ids
[i
]; i
++) {
1255 /* NOTE: this will NOT touch ID_EXPIRED entries that the backend
1256 * was not able to confirm/deny (offline mode) */
1257 if (ids
[i
]->status
== ID_UNKNOWN
||
1258 ids
[i
]->status
== ID_UNMAPPED
) {
1259 /* ok this is an unmapped one, see if we can map it */
1260 ret
= idmap_new_mapping(ctx
, ids
[i
]);
1261 if (NT_STATUS_IS_OK(ret
)) {
1262 /* successfully mapped */
1263 ids
[i
]->status
= ID_MAPPED
;
1265 if (NT_STATUS_EQUAL(ret
, NT_STATUS_NONE_MAPPED
)) {
1266 /* could not map it */
1267 ids
[i
]->status
= ID_UNMAPPED
;
1269 /* Something very bad happened down there
1270 * OR we are offline */
1271 ids
[i
]->status
= ID_UNKNOWN
;
1283 /**************************************************************************
1284 idmap interface functions
1285 **************************************************************************/
1287 NTSTATUS
idmap_unixids_to_sids(struct id_map
**ids
)
1291 struct id_map
**bids
;
1294 struct winbindd_domain
*our_domain
= find_our_domain();
1296 if (! NT_STATUS_IS_OK(ret
= idmap_init())) {
1300 if (!ids
|| !*ids
) {
1301 DEBUG(1, ("Invalid list of maps\n"));
1302 return NT_STATUS_INVALID_PARAMETER
;
1305 ctx
= talloc_named_const(NULL
, 0, "idmap_unixids_to_sids ctx");
1307 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1308 return NT_STATUS_NO_MEMORY
;
1311 /* no ids to be asked to the backends by default */
1315 for (i
= 0; ids
[i
]; i
++) {
1317 if ( ! ids
[i
]->sid
) {
1318 DEBUG(1, ("invalid null SID in id_map array"));
1320 return NT_STATUS_INVALID_PARAMETER
;
1323 ret
= idmap_cache_map_id(idmap_cache
, ids
[i
]);
1325 if ( ! NT_STATUS_IS_OK(ret
)) {
1328 /* alloc space for ids to be resolved by
1329 * backends (realloc ten by ten) */
1330 bids
= TALLOC_ARRAY(ctx
, struct id_map
*, 10);
1332 DEBUG(1, ("Out of memory!\n"));
1334 return NT_STATUS_NO_MEMORY
;
1339 /* add this id to the ones to be retrieved
1340 * from the backends */
1344 /* check if we need to allocate new space
1345 * on the rids array */
1348 bids
= talloc_realloc(ctx
, bids
,
1349 struct id_map
*, bn
);
1351 DEBUG(1, ("Out of memory!\n"));
1353 return NT_STATUS_NO_MEMORY
;
1357 /* make sure the last element is NULL */
1362 /* let's see if there is any id mapping to be retieved
1363 * from the backends */
1365 /* Only do query if we are online */
1366 if ( IS_DOMAIN_OFFLINE(our_domain
) ) {
1367 ret
= NT_STATUS_FILE_IS_OFFLINE
;
1371 ret
= idmap_backends_unixids_to_sids(bids
);
1372 IDMAP_CHECK_RET(ret
);
1374 /* update the cache */
1375 for (i
= 0; i
< bi
; i
++) {
1376 if (bids
[i
]->status
== ID_MAPPED
) {
1377 ret
= idmap_cache_set(idmap_cache
, bids
[i
]);
1378 } else if (bids
[i
]->status
== ID_EXPIRED
) {
1379 /* the cache returned an expired entry and the
1380 * backend was not able to clear the situation
1381 * (offline). This handles a previous
1382 * NT_STATUS_SYNCHRONIZATION_REQUIRED
1383 * for disconnected mode, */
1384 bids
[i
]->status
= ID_MAPPED
;
1385 } else if (bids
[i
]->status
== ID_UNKNOWN
) {
1386 /* something bad here. We were not able to
1387 * handle this for some reason, mark it as
1388 * unmapped and hope next time things will
1390 bids
[i
]->status
= ID_UNMAPPED
;
1391 } else { /* unmapped */
1392 ret
= idmap_cache_set_negative_id(idmap_cache
,
1395 IDMAP_CHECK_RET(ret
);
1405 NTSTATUS
idmap_sids_to_unixids(struct id_map
**ids
)
1409 struct id_map
**bids
;
1412 struct winbindd_domain
*our_domain
= find_our_domain();
1414 if (! NT_STATUS_IS_OK(ret
= idmap_init())) {
1418 if (!ids
|| !*ids
) {
1419 DEBUG(1, ("Invalid list of maps\n"));
1420 return NT_STATUS_INVALID_PARAMETER
;
1423 ctx
= talloc_named_const(NULL
, 0, "idmap_sids_to_unixids ctx");
1425 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1426 return NT_STATUS_NO_MEMORY
;
1429 /* no ids to be asked to the backends by default */
1433 for (i
= 0; ids
[i
]; i
++) {
1435 if ( ! ids
[i
]->sid
) {
1436 DEBUG(1, ("invalid null SID in id_map array\n"));
1438 return NT_STATUS_INVALID_PARAMETER
;
1441 ret
= idmap_cache_map_sid(idmap_cache
, ids
[i
]);
1443 if ( ! NT_STATUS_IS_OK(ret
)) {
1446 /* alloc space for ids to be resolved
1447 by backends (realloc ten by ten) */
1448 bids
= TALLOC_ARRAY(ctx
, struct id_map
*, 10);
1450 DEBUG(1, ("Out of memory!\n"));
1452 return NT_STATUS_NO_MEMORY
;
1457 /* add this id to the ones to be retrieved
1458 * from the backends */
1462 /* check if we need to allocate new space
1463 * on the ids array */
1466 bids
= talloc_realloc(ctx
, bids
,
1467 struct id_map
*, bn
);
1469 DEBUG(1, ("Out of memory!\n"));
1471 return NT_STATUS_NO_MEMORY
;
1475 /* make sure the last element is NULL */
1480 /* let's see if there is any id mapping to be retieved
1481 * from the backends */
1483 /* Only do query if we are online */
1484 if ( IS_DOMAIN_OFFLINE(our_domain
) ) {
1485 ret
= NT_STATUS_FILE_IS_OFFLINE
;
1489 ret
= idmap_backends_sids_to_unixids(bids
);
1490 IDMAP_CHECK_RET(ret
);
1492 /* update the cache */
1493 for (i
= 0; bids
[i
]; i
++) {
1494 if (bids
[i
]->status
== ID_MAPPED
) {
1495 ret
= idmap_cache_set(idmap_cache
, bids
[i
]);
1496 } else if (bids
[i
]->status
== ID_EXPIRED
) {
1497 /* the cache returned an expired entry and the
1498 * backend was not able to clear the situation
1499 * (offline). This handles a previous
1500 * NT_STATUS_SYNCHRONIZATION_REQUIRED
1501 * for disconnected mode, */
1502 bids
[i
]->status
= ID_MAPPED
;
1503 } else if (bids
[i
]->status
== ID_UNKNOWN
) {
1504 /* something bad here. We were not able to
1505 * handle this for some reason, mark it as
1506 * unmapped and hope next time things will
1508 bids
[i
]->status
= ID_UNMAPPED
;
1509 } else { /* unmapped */
1510 ret
= idmap_cache_set_negative_sid(idmap_cache
,
1513 IDMAP_CHECK_RET(ret
);
1523 NTSTATUS
idmap_set_mapping(const struct id_map
*id
)
1528 if (! NT_STATUS_IS_OK(ret
= idmap_init())) {
1533 if ((id
->sid
== NULL
) || (id
->status
!= ID_MAPPED
)) {
1534 DEBUG(1, ("NULL SID or unmapped entry\n"));
1535 return NT_STATUS_INVALID_PARAMETER
;
1538 /* TODO: check uid/gid range ? */
1540 ctx
= talloc_named_const(NULL
, 0, "idmap_set_mapping ctx");
1542 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1543 return NT_STATUS_NO_MEMORY
;
1546 /* set the new mapping */
1547 ret
= idmap_backends_set_mapping(id
);
1548 IDMAP_CHECK_RET(ret
);
1550 /* set the mapping in the cache */
1551 ret
= idmap_cache_set(idmap_cache
, id
);
1552 IDMAP_CHECK_RET(ret
);
1559 char *idmap_fetch_secret(const char *backend
, bool alloc
,
1560 const char *domain
, const char *identity
)
1566 r
= asprintf(&tmp
, "IDMAP_ALLOC_%s", backend
);
1568 r
= asprintf(&tmp
, "IDMAP_%s_%s", backend
, domain
);
1574 strupper_m(tmp
); /* make sure the key is case insensitive */
1575 ret
= secrets_fetch_generic(tmp
, identity
);