source3/winbindd/idmap_autorid.c

   1 /*
   2  *  idmap_autorid: static map between Active Directory/NT RIDs
   3  *  and RFC 2307 accounts
   4  *
   5  *  based on the idmap_rid module, but this module defines the ranges
   6  *  for the domains by automatically allocating a range for each domain
   7  *
   8  *  Copyright (C) Christian Ambach, 2010-2012
   9  *
  10  *  This program is free software; you can redistribute it and/or modify
  11  *  it under the terms of the GNU General Public License as published by
  12  *  the Free Software Foundation; either version 3 of the License, or
  13  *  (at your option) any later version.
  14  *
  15  *  This program is distributed in the hope that it will be useful,
  16  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  *  GNU General Public License for more details.
  19  *
  20  *  You should have received a copy of the GNU General Public License
  21  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  22  *
  23  */
  24
  25 /*
  26  * This module allocates ranges for domains to be used in a
  27  * algorithmic mode like idmap_rid. Multiple ranges are supported
  28  * for a single domain: If a rid exceeds the range size, a matching
  29  * range is allocated to hold the rid's id.
  30  *
  31  * Here are the formulas applied:
  32  *
  33  *
  34  * For a sid of the form domain_sid-rid, we have
  35  *
  36  *   rid = reduced_rid + domain_range_index * range_size
  37  *
  38  * with
  39  *   reduced_rid := rid % range_size
  40  *   domain_range_index := rid / range_size
  41  *
  42  * And reduced_rid fits into a range.
  43  *
  44  * In the database, we associate a range_number to
  45  * the pair domain_sid,domain_range_index.
  46  *
  47  * Now the unix id for the given sid calculates as:
  48  *
  49  *   id = reduced_rid + range_low_id
  50  *
  51  * with
  52  *
  53  *   range_low_id = low_id + range_number * range_size
  54  *
  55  *
  56  * The inverse calculation goes like this:
  57  *
  58  * Given a unix id, let
  59  *
  60  *   normalized_id := id - low_id
  61  *   reduced_rid := normalized_id % range_size
  62  *   range_number = normalized_id / range_size
  63  *
  64  * Then we have
  65  *
  66  *   id = reduced_rid + low_id + range_number * range_size
  67  *
  68  * From the database, get the domain_sid,domain_range_index pair
  69  * belonging to the range_number (if there is already one).
  70  *
  71  * Then the rid for the unix id calculates as:
  72  *
  73  *   rid = reduced_rid + domain_range_index * range_size
  74  */
  75
  76 #include "idmap_autorid_tdb.h"
  77 #include "winbindd.h"
  78 #include "idmap.h"
  79 #include "idmap_rw.h"
  80 #include "../libcli/security/dom_sid.h"
  81
  82 #undef DBGC_CLASS
  83 #define DBGC_CLASS DBGC_IDMAP
  84
  85 /* handle to the tdb storing domain <-> range assignments */
  86 static struct db_context *autorid_db;
  87
  88 static bool ignore_builtin = false;
  89
  90 static NTSTATUS idmap_autorid_allocate_id(struct idmap_domain *dom,
  91                                           struct unixid *xid) {
  92
  93         NTSTATUS ret;
  94         struct autorid_range_config range;
  95
  96         if (dom->read_only) {
  97                 DEBUG(3, ("Backend is read-only, refusing "
  98                           "new allocation request\n"));
  99                 return NT_STATUS_UNSUCCESSFUL;
 100         }
 101
 102         /* fetch the range for the allocation pool */
 103
 104         ZERO_STRUCT(range);
 105
 106         fstrcpy(range.domsid, ALLOC_RANGE);
 107
 108         ret = idmap_autorid_get_domainrange(autorid_db, &range, dom->read_only);
 109
 110         if (!NT_STATUS_IS_OK(ret)) {
 111                 DEBUG(3, ("Could not determine range for allocation pool, "
 112                           "check previous messages for reason\n"));
 113                 return ret;
 114         }
 115
 116         ret = idmap_tdb_common_get_new_id(dom, xid);
 117
 118         if (!NT_STATUS_IS_OK(ret)) {
 119                 DEBUG(1, ("Fatal error while allocating new ID!\n"));
 120                 return ret;
 121         }
 122
 123         xid->id = xid->id + range.low_id;
 124
 125         DEBUG(10, ("Returned new %s %d from allocation range\n",
 126                    (xid->type==ID_TYPE_UID)?"uid":"gid", xid->id));
 127
 128         return ret;
 129 }
 130
 131 /*
 132  * map a SID to xid using the idmap_tdb like pool
 133  */
 134 static NTSTATUS idmap_autorid_map_id_to_sid(struct idmap_domain *dom,
 135                                             struct id_map *map)
 136 {
 137         NTSTATUS ret;
 138
 139         /* look out for the mapping */
 140         ret = idmap_tdb_common_unixid_to_sid(dom, map);
 141
 142         if (NT_STATUS_IS_OK(ret)) {
 143                 map->status = ID_MAPPED;
 144                 return ret;
 145         }
 146
 147         map->status = ID_UNKNOWN;
 148
 149         DEBUG(10, ("no ID->SID mapping for %d could be found\n", map->xid.id));
 150
 151         return ret;
 152 }
 153
 154 static NTSTATUS idmap_autorid_id_to_sid(struct autorid_global_config *cfg,
 155                                         struct idmap_domain *dom,
 156                                         struct id_map *map)
 157 {
 158         uint32_t range_number;
 159         uint32_t domain_range_index = 0;
 160         uint32_t normalized_id;
 161         uint32_t reduced_rid;
 162         uint32_t rid;
 163         TDB_DATA data = tdb_null;
 164         char *keystr;
 165         struct dom_sid domsid;
 166         NTSTATUS status;
 167         bool ok;
 168         const char *q = NULL;
 169
 170         /* can this be one of our ids? */
 171         if (map->xid.id < cfg->minvalue) {
 172                 DEBUG(10, ("id %d is lower than minimum value, "
 173                            "ignoring mapping request\n", map->xid.id));
 174                 map->status = ID_UNKNOWN;
 175                 return NT_STATUS_OK;
 176         }
 177
 178         if (map->xid.id > (cfg->minvalue + cfg->rangesize * cfg->maxranges)) {
 179                 DEBUG(10, ("id %d is outside of maximum id value, "
 180                            "ignoring mapping request\n", map->xid.id));
 181                 map->status = ID_UNKNOWN;
 182                 return NT_STATUS_OK;
 183         }
 184
 185         /* determine the range of this uid */
 186
 187         normalized_id = map->xid.id - cfg->minvalue;
 188         range_number = normalized_id / cfg->rangesize;
 189
 190         keystr = talloc_asprintf(talloc_tos(), "%u", range_number);
 191         if (!keystr) {
 192                 return NT_STATUS_NO_MEMORY;
 193         }
 194
 195         status = dbwrap_fetch_bystring(autorid_db, talloc_tos(), keystr, &data);
 196         TALLOC_FREE(keystr);
 197
 198         if (!NT_STATUS_IS_OK(status)) {
 199                 DEBUG(4, ("id %d belongs to range %d which does not have "
 200                           "domain mapping, ignoring mapping request\n",
 201                           map->xid.id, range_number));
 202                 TALLOC_FREE(data.dptr);
 203                 map->status = ID_UNKNOWN;
 204                 return NT_STATUS_OK;
 205         }
 206
 207         if (strncmp((const char *)data.dptr,
 208                     ALLOC_RANGE,
 209                     strlen(ALLOC_RANGE)) == 0) {
 210                 /*
 211                  * this is from the alloc range, check if there is a mapping
 212                  */
 213                 DEBUG(5, ("id %d belongs to allocation range, "
 214                           "checking for mapping\n",
 215                           map->xid.id));
 216                 TALLOC_FREE(data.dptr);
 217                 return idmap_autorid_map_id_to_sid(dom, map);
 218         }
 219
 220         ok = dom_sid_parse_endp((const char *)data.dptr, &domsid, &q);
 221         TALLOC_FREE(data.dptr);
 222         if (!ok) {
 223                 map->status = ID_UNKNOWN;
 224                 return NT_STATUS_OK;
 225         }
 226         if ((q != NULL) && (*q != '\0'))
 227                 if (sscanf(q+1, "%"SCNu32, &domain_range_index) != 1) {
 228                         DEBUG(10, ("Domain range index not found, "
 229                                    "ignoring mapping request\n"));
 230                         map->status = ID_UNKNOWN;
 231                         return NT_STATUS_OK;
 232                 }
 233
 234         reduced_rid = normalized_id % cfg->rangesize;
 235         rid = reduced_rid + domain_range_index * cfg->rangesize;
 236
 237         sid_compose(map->sid, &domsid, rid);
 238
 239         /* We **really** should have some way of validating
 240            the SID exists and is the correct type here.  But
 241            that is a deficiency in the idmap_rid design. */
 242
 243         map->status = ID_MAPPED;
 244         map->xid.type = ID_TYPE_BOTH;
 245
 246         return NT_STATUS_OK;
 247 }
 248
 249 /**********************************
 250  Single sid to id lookup function.
 251 **********************************/
 252
 253 static NTSTATUS idmap_autorid_sid_to_id(struct autorid_global_config *global,
 254                                         struct autorid_range_config *range,
 255                                         struct id_map *map)
 256 {
 257         uint32_t rid;
 258         uint32_t reduced_rid;
 259
 260         sid_peek_rid(map->sid, &rid);
 261
 262         reduced_rid = rid % global->rangesize;
 263
 264         map->xid.id = reduced_rid + range->low_id;
 265         map->xid.type = ID_TYPE_BOTH;
 266
 267         /* We **really** should have some way of validating
 268            the SID exists and is the correct type here.  But
 269            that is a deficiency in the idmap_rid design. */
 270
 271         map->status = ID_MAPPED;
 272
 273         return NT_STATUS_OK;
 274 }
 275
 276 /**********************************
 277  lookup a set of unix ids.
 278 **********************************/
 279
 280 static NTSTATUS idmap_autorid_unixids_to_sids(struct idmap_domain *dom,
 281                                               struct id_map **ids)
 282 {
 283         struct idmap_tdb_common_context *commoncfg;
 284         struct autorid_global_config *globalcfg;
 285         NTSTATUS ret;
 286         int i;
 287         int num_tomap = 0;
 288         int num_mapped = 0;
 289
 290         /* initialize the status to avoid surprise */
 291         for (i = 0; ids[i]; i++) {
 292                 ids[i]->status = ID_UNKNOWN;
 293                 num_tomap++;
 294         }
 295
 296         commoncfg =
 297             talloc_get_type_abort(dom->private_data,
 298                                   struct idmap_tdb_common_context);
 299
 300         globalcfg = talloc_get_type(commoncfg->private_data,
 301                                     struct autorid_global_config);
 302
 303         for (i = 0; ids[i]; i++) {
 304
 305                 ret = idmap_autorid_id_to_sid(globalcfg, dom, ids[i]);
 306
 307                 if ((!NT_STATUS_IS_OK(ret)) &&
 308                     (!NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED))) {
 309                         /* some fatal error occurred, log it */
 310                         DEBUG(3, ("Unexpected error resolving an ID "
 311                                   " (%d)\n", ids[i]->xid.id));
 312                         goto failure;
 313                 }
 314
 315                 if (NT_STATUS_IS_OK(ret) && ids[i]->status == ID_MAPPED) {
 316                         num_mapped++;
 317                 }
 318
 319         }
 320
 321         if (num_tomap == num_mapped) {
 322                 return NT_STATUS_OK;
 323         } else if (num_mapped == 0) {
 324                 return NT_STATUS_NONE_MAPPED;
 325         }
 326
 327         return STATUS_SOME_UNMAPPED;
 328
 329
 330       failure:
 331         return ret;
 332 }
 333
 334 /*
 335  * map a SID to xid using the idmap_tdb like pool
 336  */
 337 static NTSTATUS idmap_autorid_map_sid_to_id(struct idmap_domain *dom,
 338                                             struct id_map *map,
 339                                             struct idmap_tdb_common_context *ctx)
 340 {
 341         NTSTATUS ret;
 342         int res;
 343
 344         /* see if we already have a mapping */
 345         ret = idmap_tdb_common_sid_to_unixid(dom, map);
 346
 347         if (NT_STATUS_IS_OK(ret)) {
 348                 map->status = ID_MAPPED;
 349                 return ret;
 350         }
 351
 352         /* bad things happened */
 353         if (!NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED)) {
 354                 DEBUG(1, ("Looking up SID->ID mapping for %s failed\n",
 355                           sid_string_dbg(map->sid)));
 356                 return ret;
 357         }
 358
 359         if (dom->read_only) {
 360                 DEBUG(3, ("Not allocating new mapping for %s, because backend "
 361                           "is read-only\n", sid_string_dbg(map->sid)));
 362                 return NT_STATUS_NONE_MAPPED;
 363         }
 364
 365         DEBUG(10, ("Creating new mapping in pool for %s\n",
 366                    sid_string_dbg(map->sid)));
 367
 368         /* create new mapping */
 369         res = dbwrap_transaction_start(ctx->db);
 370         if (res != 0) {
 371                 DEBUG(2, ("transaction_start failed\n"));
 372                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 373         }
 374
 375         ret = idmap_tdb_common_new_mapping(dom, map);
 376
 377         map->status = (NT_STATUS_IS_OK(ret))?ID_MAPPED:ID_UNMAPPED;
 378
 379         if (!NT_STATUS_IS_OK(ret)) {
 380                 if (dbwrap_transaction_cancel(ctx->db) != 0) {
 381                         smb_panic("Cancelling transaction failed");
 382                 }
 383                 return ret;
 384         }
 385
 386         res = dbwrap_transaction_commit(ctx->db);
 387         if (res == 0) {
 388                 return ret;
 389         }
 390
 391         DEBUG(2, ("transaction_commit failed\n"));
 392         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 393
 394 }
 395
 396 /**********************************
 397  lookup a set of sids.
 398 **********************************/
 399
 400 static NTSTATUS idmap_autorid_sids_to_unixids(struct idmap_domain *dom,
 401                                               struct id_map **ids)
 402 {
 403         struct idmap_tdb_common_context *commoncfg;
 404         struct autorid_global_config *global;
 405         NTSTATUS ret;
 406         int i;
 407         int num_tomap = 0;
 408         int num_mapped = 0;
 409
 410         /* initialize the status to avoid surprise */
 411         for (i = 0; ids[i]; i++) {
 412                 ids[i]->status = ID_UNKNOWN;
 413                 num_tomap++;
 414         }
 415
 416         commoncfg =
 417             talloc_get_type_abort(dom->private_data,
 418                                   struct idmap_tdb_common_context);
 419
 420         global = talloc_get_type(commoncfg->private_data,
 421                                  struct autorid_global_config);
 422
 423         for (i = 0; ids[i]; i++) {
 424                 struct winbindd_tdc_domain *domain;
 425                 struct autorid_range_config range;
 426                 uint32_t rid;
 427                 struct dom_sid domainsid;
 428
 429                 ZERO_STRUCT(range);
 430
 431                 DEBUG(10, ("Trying to map %s\n", sid_string_dbg(ids[i]->sid)));
 432
 433                 sid_copy(&domainsid, ids[i]->sid);
 434                 if (!sid_split_rid(&domainsid, &rid)) {
 435                         DEBUG(4, ("Could not determine domain SID from %s, "
 436                                   "ignoring mapping request\n",
 437                                   sid_string_dbg(ids[i]->sid)));
 438                         continue;
 439                 }
 440
 441                 /* is this a well-known SID? */
 442
 443                 if (sid_check_is_wellknown_domain(&domainsid, NULL)) {
 444
 445                         DEBUG(10, ("SID %s is well-known, using pool\n",
 446                                    sid_string_dbg(ids[i]->sid)));
 447
 448                         ret = idmap_autorid_map_sid_to_id(dom, ids[i],
 449                                                           commoncfg);
 450
 451                         if (!NT_STATUS_IS_OK(ret) &&
 452                             !NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED)) {
 453                                 DEBUG(3, ("Unexpected error resolving "
 454                                           "SID (%s)\n",
 455                                           sid_string_dbg(ids[i]->sid)));
 456                                 goto failure;
 457                         }
 458
 459                         if (ids[i]->status == ID_MAPPED) {
 460                                 num_mapped++;
 461                         }
 462
 463                         continue;
 464                 }
 465
 466                 /* BUILTIN is passdb's job */
 467                 if (dom_sid_equal(&domainsid, &global_sid_Builtin) &&
 468                     ignore_builtin) {
 469                         DEBUG(10, ("Ignoring request for BUILTIN domain\n"));
 470                         continue;
 471                 }
 472
 473                 /*
 474                  * Check if the domain is around
 475                  */
 476                 domain = wcache_tdc_fetch_domainbysid(talloc_tos(),
 477                                                       &domainsid);
 478                 if (domain == NULL) {
 479                         DEBUG(10, ("Ignoring unknown domain sid %s\n",
 480                                    sid_string_dbg(&domainsid)));
 481                         continue;
 482                 }
 483                 TALLOC_FREE(domain);
 484
 485                 sid_to_fstring(range.domsid, &domainsid);
 486
 487                 /* Calculate domain_range_index for multi-range support */
 488                 range.domain_range_index = rid / (global->rangesize);
 489
 490                 ret = idmap_autorid_get_domainrange(autorid_db, &range,
 491                                                     dom->read_only);
 492
 493                 /* read-only mode and a new domain range would be required? */
 494                 if (NT_STATUS_EQUAL(ret, NT_STATUS_NOT_FOUND) &&
 495                     dom->read_only) {
 496                         DEBUG(10, ("read-only is enabled, did not allocate "
 497                                    "new range for domain %s\n",
 498                                    sid_string_dbg(&domainsid)));
 499                         continue;
 500                 }
 501
 502                 if (!NT_STATUS_IS_OK(ret)) {
 503                         DEBUG(3, ("Could not determine range for domain, "
 504                                   "check previous messages for reason\n"));
 505                         goto failure;
 506                 }
 507
 508                 ret = idmap_autorid_sid_to_id(global, &range, ids[i]);
 509
 510                 if ((!NT_STATUS_IS_OK(ret)) &&
 511                     (!NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED))) {
 512                         /* some fatal error occurred, log it */
 513                         DEBUG(3, ("Unexpected error resolving a SID (%s)\n",
 514                                   sid_string_dbg(ids[i]->sid)));
 515                         goto failure;
 516                 }
 517
 518                 if (NT_STATUS_IS_OK(ret)) {
 519                         num_mapped++;
 520                 }
 521         }
 522
 523         if (num_tomap == num_mapped) {
 524                 return NT_STATUS_OK;
 525         } else if (num_mapped == 0) {
 526                 return NT_STATUS_NONE_MAPPED;
 527         }
 528
 529         return STATUS_SOME_UNMAPPED;
 530
 531       failure:
 532         return ret;
 533
 534 }
 535
 536 static NTSTATUS idmap_autorid_preallocate_wellknown(struct idmap_domain *dom)
 537 {
 538         const char *groups[] = { "S-1-1-0", "S-1-2-0", "S-1-2-1",
 539                 "S-1-3-0", "S-1-3-1", "S-1-3-2", "S-1-3-3", "S-1-3-4",
 540                 "S-1-5-1", "S-1-5-2", "S-1-5-3", "S-1-5-4", "S-1-5-6",
 541                 "S-1-5-7", "S-1-5-8", "S-1-5-9", "S-1-5-10", "S-1-5-11",
 542                 "S-1-5-12", "S-1-5-13", "S-1-5-14", "S-1-5-15",
 543                 "S-1-5-17", "S-1-5-18", "S-1-5-19", "S-1-5-20"
 544         };
 545
 546         struct id_map **maps;
 547         int i, num;
 548         NTSTATUS status;
 549
 550         if (dom->read_only) {
 551                 return NT_STATUS_OK;
 552         }
 553
 554         num = ARRAY_SIZE(groups);
 555
 556         maps = talloc_array(talloc_tos(), struct id_map*, num+1);
 557         if (!maps) {
 558                 return NT_STATUS_NO_MEMORY;
 559         }
 560
 561         for (i = 0; i < num; i++) {
 562                 maps[i] = talloc(maps, struct id_map);
 563                 if (maps[i] == NULL) {
 564                         talloc_free(maps);
 565                         return NT_STATUS_NO_MEMORY;
 566                 }
 567                 maps[i]->xid.type = ID_TYPE_GID;
 568                 maps[i]->sid = dom_sid_parse_talloc(maps, groups[i]);
 569         }
 570
 571         maps[num] = NULL;
 572
 573         status = idmap_autorid_sids_to_unixids(dom, maps);
 574
 575         DEBUG(10,("Preallocation run finished with status %s\n",
 576                   nt_errstr(status)));
 577
 578         talloc_free(maps);
 579
 580         return NT_STATUS_IS_OK(status)?NT_STATUS_OK:NT_STATUS_UNSUCCESSFUL;
 581 }
 582
 583 static NTSTATUS idmap_autorid_initialize(struct idmap_domain *dom)
 584 {
 585         struct idmap_tdb_common_context *commonconfig;
 586         struct autorid_global_config *config;
 587         NTSTATUS status;
 588
 589         if (!strequal(dom->name, "*")) {
 590                 DEBUG(0, ("idmap_autorid_initialize: Error: autorid configured "
 591                           "for domain '%s'. But autorid can only be used for "
 592                           "the default idmap configuration.\n", dom->name));
 593                 return NT_STATUS_INVALID_PARAMETER;
 594         }
 595
 596         commonconfig = talloc_zero(dom, struct idmap_tdb_common_context);
 597         if (!commonconfig) {
 598                 DEBUG(0, ("Out of memory!\n"));
 599                 return NT_STATUS_NO_MEMORY;
 600         }
 601
 602         commonconfig->rw_ops = talloc_zero(commonconfig, struct idmap_rw_ops);
 603         if (commonconfig->rw_ops == NULL) {
 604                 DEBUG(0, ("Out of memory!\n"));
 605                 return NT_STATUS_NO_MEMORY;
 606         }
 607
 608         config = talloc_zero(commonconfig, struct autorid_global_config);
 609         if (!config) {
 610                 DEBUG(0, ("Out of memory!\n"));
 611                 return NT_STATUS_NO_MEMORY;
 612         }
 613
 614         status = idmap_autorid_db_init(state_path("autorid.tdb"),
 615                                        NULL, /* TALLOC_CTX */
 616                                        &autorid_db);
 617         if (!NT_STATUS_IS_OK(status)) {
 618                 goto error;
 619         }
 620
 621         config->minvalue = dom->low_id;
 622         config->rangesize = lp_parm_int(-1, "idmap config *",
 623                                         "rangesize", 100000);
 624
 625         config->maxranges = (dom->high_id - dom->low_id + 1) /
 626             config->rangesize;
 627
 628         if (config->maxranges == 0) {
 629                 DEBUG(1, ("allowed uid range is smaller then rangesize, "
 630                           "increase uid range or decrease rangesize\n"));
 631                 status = NT_STATUS_INVALID_PARAMETER;
 632                 goto error;
 633         }
 634
 635         /* check if the high-low limit is a multiple of the rangesize */
 636         if ((dom->high_id - dom->low_id + 1) % config->rangesize != 0) {
 637                 DEBUG(5, ("High uid-low uid difference of %d "
 638                           "is not a multiple of the rangesize %d, "
 639                           "limiting ranges to lower boundary number of %d\n",
 640                           (dom->high_id - dom->low_id + 1), config->rangesize,
 641                           config->maxranges));
 642         }
 643
 644         status = idmap_autorid_saveconfig(autorid_db, config);
 645
 646         if (!NT_STATUS_IS_OK(status)) {
 647                 DEBUG(1, ("Failed to store configuration data!\n"));
 648                 goto error;
 649         }
 650
 651         DEBUG(5, ("%d domain ranges with a size of %d are available\n",
 652                   config->maxranges, config->rangesize));
 653
 654         ignore_builtin = lp_parm_bool(-1, "idmap config *",
 655                                       "ignore builtin", false);
 656
 657         /* fill the TDB common configuration */
 658         commonconfig->private_data = config;
 659
 660         commonconfig->db = autorid_db;
 661         commonconfig->max_id = config->rangesize -1;
 662         commonconfig->hwmkey_uid = ALLOC_HWM_UID;
 663         commonconfig->hwmkey_gid = ALLOC_HWM_GID;
 664         commonconfig->rw_ops->get_new_id = idmap_autorid_allocate_id;
 665         commonconfig->rw_ops->set_mapping = idmap_tdb_common_set_mapping;
 666
 667         dom->private_data = commonconfig;
 668
 669         /* preallocate well-known SIDs in the pool */
 670         status = idmap_autorid_preallocate_wellknown(dom);
 671
 672         goto done;
 673
 674 error:
 675         talloc_free(config);
 676
 677 done:
 678         return status;
 679 }
 680
 681 /*
 682   Close the idmap tdb instance
 683 */
 684 static struct idmap_methods autorid_methods = {
 685         .init = idmap_autorid_initialize,
 686         .unixids_to_sids = idmap_autorid_unixids_to_sids,
 687         .sids_to_unixids = idmap_autorid_sids_to_unixids,
 688         .allocate_id     = idmap_autorid_allocate_id
 689 };
 690
 691 NTSTATUS samba_init_module(void)
 692 {
 693         return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION,
 694                                   "autorid", &autorid_methods);
 695 }